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ABSTRACT 


The  aviation  industry  is  a  large  network  of  agglomerated  systems  that  connects  people 
and  places.  Since  the  9/11  attacks,  aviation  security  in  the  United  States  has  undergone 
tremendous  changes  and  improvements.  Nonetheless,  threat  detection  mechanisms 
remain  imperfect  as  seen  from  hijacking  attempts  by  passengers  who  have  gone 
undetected  via  security. 

Alternate  ways  of  thinking  and  looking  at  security  was  explored  through  a  system 
perspective.  The  focus  was  on  passenger  security  system  with  the  intention  of  identifying 
potential  areas  of  improvement  for  aviation  security  with  terrorist  using  aircraft  as  a 
weapon.  A  supply  chain  approach  was  taken  as  the  model  to  move  and  deliver  people  as 
goods  through  security  checks  to  the  aircrafts.  Together  with  this  approach,  the  concept 
of  risks,  uncertainties  and  the  associated  risk  assessment  of  potentially  defective  “goods” 
were  examined. 

A  systems  engineering  process  was  used.  Through  systematic  analysis 
scrutinizing  interactions  between  airport  objects  and  passengers  (as  objects),  this  thesis 
pin-points  possible  gaps,  and  thereby  identify  approaches  or  means  to  safeguard  and 
counter  these  risks.  Analysis  included  the  exploration  of  the  trade  space  between  different 
entities  within  the  system  and  the  interactions  between  objects,  functions,  processes,  and 
its  associated  results. 
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EXECUTIVE  SUMMARY 


The  aviation  industry  is  comprised  of  various  systems,  agglomerated  into  a  large  network 
of  systems  that  connects  people  and  places.  Each  day,  millions  of  travelers  rely  heavily 
on  this  system  of  systems  (SoS)  for  transportation  between  domestic  and  global  locations. 
According  to  the  Bureau  of  Transportation  Statistics,  an  average  of  about  1.76  million 
domestic  passengers  boarded  domestic  flights  in  the  United  States  in  2012.  The 
September  11  hijacking  of  aircraft  in  a  coordinated  terrorist  attack  in  the  United  States 
was  a  milestone  in  the  history  of  aviation  security.  Since  the  9/11  attacks,  aviation 
security  in  United  States  has  undergone  tremendous  changes  with  a  defense-in-depth 
approach.  While  improvements  have  been  incorporated  into  aviation  security  at  airports, 
threat  detection  mechanisms  remain  imperfect  as  seen  from  the  occasional  reports  of 
hijacking  attempts  by  passengers  who  have  gone  undetected  via  the  various  layers  of 
security. 

Alternate  ways  of  thinking  and  analyzing  security  were  explored  through  a  system 
perspective.  The  focus  was  on  passenger  security  system  within  the  aviation  security  SoS, 
with  the  intention  of  identifying  potential  areas  of  improvement  for  aviation  security  with 
terrorists  using  aircraft  as  a  weapon.  A  supply  chain  approach  was  taken  to  model 
movement  and  delivery  of  people  as  goods  through  security  checks  to  their  respective 
aircrafts.  The  analogy  is  for  passengers  to  pass  through  various  phases  in  the  supply 
chain,  with  each  phase  being  the  means  of  detecting  “security  defects”  in  the  “goods” 
(i.e.,  passengers).  The  purpose  is  to  have  a  flow  of  goods  through  the  supply  chain  in  a 
timely  fashion  with  the  end  state  of  delivering  defect-free  passengers  with  the  appropriate 
certification  of  security  at  the  doorstep  of  each  outbound  aircraft.  Together  with  this 
approach,  the  concept  of  risks,  uncertainties,  and  the  associated  risk  assessment  of 
potentially  defective  goods  as  they  flow  through  the  supply  chain  was  also  examined. 

A  systems  engineering  process  premised  on  problem  solving  that  was  iterative, 
recursive,  and  illative  was  used.  A  systematic  analysis  of  the  airport  passenger  security 
system  was  performed,  scrutinizing  interactions  between  airport  objects  and  passengers 
(as  objects)  to  pin-point  possible  gaps  and  vulnerabilities  that  could  be  potentially 


xv 


exploited  by  malicious  parties,  and  thereby  identify  approaches,  means  or  even  measures 
to  safeguard  and  counter  against  these  risks.  The  analysis  included  the  exploration  of 
trade  space  between  the  different  entities  within  the  system  and  the  interactions  between 
objects,  functions,  processes,  and  its  associated  results.  Through  the  analysis,  new 
security  measures  and  processes  for  improvement  were  identified. 
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I.  INTRODUCTION 


A.  BACKGROUND 

The  first  reported  hijacking  of  aircraft  was  traced  to  1931  in  Peru  (Jenkins,  n.d.). 
Since  then,  aircraft  have  been  hijacked  for  various  reasons  ranging  from  hijackers 
seeking  asylum  to  the  exchange  of  prisoners.  Over  the  years,  terrorists  have 
“revolutionized”  the  hijacking  of  commercial  aircraft  by  using  aircraft-as- weapons  to 
attack  targets  of  interest.  Most  notably,  the  simultaneous  hijacking  of  four  aircraft  by  Al- 
Qaeda- affiliated  extremists  on  September  1 1  culminated  in  a  coordinated  terrorist  attack 
on  civilian  and  government  targets  in  the  United  States.  The  magnitude  and  significance 
of  this  attack  continues  to  have  lasting  effects  on  the  global  landscape  of  aviation  security 
as  well  as  on  behaviors  and  attitudes  worldwide.  According  to  the  Government 
Accountability  Office  (GAO)  Report,  Department  of  Homeland  Security:  Progress  made 
and  work  remaining  in  implementing  Homeland  Security  missions  10  years  after  9/11, 
“in  the  aftermath  of  the  attacks,  the  Department  of  Homeland  Security  (DHS)  was  created 
with  key  missions1  that  include  preventing  terrorist  attacks  from  occurring  within  the 
United  States”  (GAO,  2011). 

The  current  aviation  security  system  in  the  United  States  is  based  on  a  defense-in¬ 
depth  approach  which  implies  sequential  and  layered  mechanisms  that  enact  security 
functions  to  increase  freedom  from  danger  or  threat.  Multi-layered  security  enacted 
through  a  sequence  of  overlapping  security  mechanisms  provides  validation  and 
verification  of  performance,  as  well  as  time  to  detect,  evaluate  and  respond  to  threats. 
The  security  risks  or  threats  that  are  being  detected  by  mechanisms  are  known  as  security 
defects  in  the  context  of  this  thesis.  The  detection  of  defects  would  save  lives  and 
minimize  damage.  Effective  detection  is  based  on  the  principle  that  the  greater  the 
distance  and  time  allotted  to  detection,  the  higher  the  probability  there  is  for  detecting 
defects.  These  layers  of  security  mechanisms  include  intelligence  collection  and  analyses, 
pre-screening  of  passengers,  access  control  to  airport  areas,  passenger  security  screening, 

1  Aviation  security  is  one  of  the  Functional  Mission  Area  of  the  DHS. 
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passenger  checked  baggage  screening,  cargo  screening,  and  on-flight  security.  While 
each  individual  security  layer  is  aimed  at  a  specific  threat  identified  in  aviation  travel, 
these  layers  collectively  are  intended  to  provide  a  secure  environment  in  general  for 
aviation  travel.  The  majority  of  these  security  mechanisms  across  the  various  security 
layers  is  intended  to  be  transparent  to  an  individual  bound  for  air  travel  as  these  measures 
are  being  implemented  and  performed  in  the  background.  A  few  exceptions  to  this 
intended  transparency  are  passenger  security  screening2  and  passenger  checked  baggage 
screening3  which  involve  a  direct  interaction  with  the  individual  traveling.  While 
improvements  have  been  incorporated  into  aviation  security  at  airports,  there  are  still 
occasional  reports  of  hijacking  attempts  by  individuals  who  have  gone  undetected  via  the 
various  layers  of  security. 

B.  THESIS  MOTIVATION  AND  FOCUS 

The  objectives  of  the  thesis  are  to  identify  different  ways  of  thinking  about  and 
looking  at  security  and  to  identify  potential  areas  of  improvement  for  aviation  security. 
Particular  attention  was  placed  on  preventing  the  use  of  aircraft  as  a  weapon.  The  thesis 
focused  on  the  passenger  security  system  within  the  aviation  security  system  of  systems 
(SoS).  The  research  was  carried  out  over  a  nine-month  period  and  examined  the 
interactions  between  airport  objects  and  passengers  (as  objects)  bound  for  air  travel  with 
the  purpose  of  identifying  new  ways  of  thinking  about  security  and  potential 
improvements  to  security,  in  terms  of  both  mechanisms  and  processes. 

C.  PROBLEM  DEFINITION 

The  aviation  industry  is  comprised  of  various  systems,  agglomerated  into  a  large 
network  of  systems  that  connects  people  and  places.  Each  day,  millions  of  travelers  rely 
heavily  on  this  SoS  for  transportation  between  domestic  and  global  locations.  While  the 
images  and  effects  of  the  9/11  attacks  remain  vividly  in  the  minds  of  many  travelers,  the 


2  This  comprises  both  security  checks  of  carry-on  baggage  and  physical  inspection  of  individuals 
bound  for  air  travel. 

3  Direct  interaction  with  individuals  occurs  when  the  checked  baggage  poses  problems  to  security 
personnel  during  physical  inspection. 
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impact  of  the  immediate  aftermath  on  air  passenger  travel  was  overcome  when  air 
passenger  travel  reached  its  pre-9/11  peak  in  July  2004  (Notis,  2005).  Since  mid-2004, 
the  number  of  travelers  has  continued  to  grow.  According  to  the  Bureau  of  Transportation 
Statistics,  a  total  of  642,202,749  passengers  (RITA-BTS,  n.d.)  boarded  domestic  flights 
in  the  United  States  in  2012.  This  magnitude  of  passengers  translates  into  an  average  of 
about  1.76  million  domestic  passengers  per  day  distributed  across  the  airports  in  United 
States. 

Since  the  9/11  attacks,  aviation  security  in  the  United  States  has  undergone 
tremendous  changes  in  security  and  improvements  in  passenger  safety.  With  the  passage 
of  the  Aviation  and  Transportation  Security  Act,  the  National  Strategy  for  Aviation 
Security  implemented  a  robust  system  of  detection,  protection  and  interdiction  through  20 
layers  of  security  actions  in  place  at  more  than  450  airports  (Pistole,  2011).  Amongst  the 
various  systems  and  elements  within  the  aviation  security  system,  those  involving  the 
passenger  have  a  direct  impact  on  the  possible  use  of  the  aircraft  as  a  weapon  to  carry  out 
an  attack,  as  demonstrated  in  the  9/11  attacks.  While  the  authorities  continue  to  refine  and 
enhance  the  aviation  security  SoS,  the  ability  to  focus  on  the  passenger  security  system 
amidst  other  systems  at  the  airport  is  of  core  relevance. 

The  problem  is  the  existing  threat  mechanisms  for  detecting  defects  are  imperfect. 
Imperfect  mechanisms  generally  require  redundancy  and  sequential  implementation.  This 
approach  of  using  overlapping  mechanisms  can  be  in  either  the  spatial  or  temporal 
domain,  or  both.  Further,  the  failure  of  mechanisms  that  detect  and  identify  anomalous 
behaviors  may  allow  a  breach  of  security  to  pass  unnoticed  without  a  sufficiency  of  time 
to  recognize  the  breach  with  some  form  of  backup  mechanism(s). 

Possible  alternative  solutions  include:  improving  technology;  improving 
mechanisms;  increasing  depth  (the  number  and  the  distance-time  factor  that  determines 
“depth”)  and  effectiveness  of  the  mechanisms,  and  increasing  redundancy  through 
overlap  and  adding  more  mechanisms.  Additionally,  solutions  would  include  changes  or 
additions/deletions  to  processes  (procedures,  activities,  and  acts). 
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D.  APPROACH,  AND  METHODOLOGY 

Airport  security  currently  adopts  a  risk-based  approach  toward  passenger 
screening  (TSA,  2013e),  categorizing  the  majority  of  passengers  to  be  low  risk.  The 
limitation  of  such  an  approach  is  the  shifting  of  focus  to  a  smaller  group  of  passengers  by 
facilitating  faster  security  clearance  for  passengers  identified  and  categorized  to  be  of  low 
risk.  While  this  seems  to  be  a  logical  approach  from  many  perspectives,  it  is  susceptible 
to  the  inaccuracy  and  quality  of  the  categorization  of  low  risk  passengers.  To  improve  the 
detection  of  would-be-terrorists,  the  approach  taken  in  this  thesis  is  to  view  the 
movement  of  people  through  the  airport  to  the  aircraft  as  a  supply  chain,  harnessing  its 
characteristics  of  defect  detection  and  continuous  monitoring. 

With  the  intent  of  adopting  different  ways  of  thinking  about  and  looking  at 
security,  a  systems  perspective  was  taken  (as  opposed  to  SoS  perspective)  on  the 
passenger  security  system.  Langford  (2012)  defined  a  system  as  “a  bounded,  stable  group 
of  objects  exhibiting  properties  that  through  the  interactions  and  exchange  of  energy, 
matter,  material  wealth,  and  information  (EMMI)  provide  functions.”  A  system  can  also 
be  understood  from  Maier  and  Rechtin  (2009)  as  “a  collection  of  things  or  elements  that, 
working  together,  produce  a  result  not  achievable  by  the  things  alone.”  Thinking  of  the 
passenger  security  system  as  a  “system”  implies  that  a  terrorist  is  part  of  the  passenger 
security  system  (as  a  participant),  but  an  externality  to  the  system  (as  a  disruptor). 
Langford  (2012)  defined  an  SoS  to  be  “a  set  of  systems  that  are  both  integrated  and 
interoperable  to  achieve  a  set  of  metasystem  functions  in  which  all  the  component 
systems  participate.”  Jamshidi  (2009)  has  reviewed  several  potential  definitions  of  SoS 
and  defined  SoS  as  “large-scale  integrated  systems  that  are  heterogeneous  and 
independently  operable  on  their  own,  but  are  networked  together  for  a  common  goal.” 
Thinking  of  the  passenger  security  system  as  part  of  an  SoS  implies  that  a  terrorist  is  not 
a  part  of  the  “system,”  but  rather  part  of  another  system,  i.e.,  the  “terrorist  system.”  In  the 
SoS  construct,  the  passenger  security  system  interacts  with  the  “terrorist  system.” 

In  the  context  of  this  thesis,  the  passenger  security  system  possessed  the 
conditions  to  be  a  system  when  it  was  able  to  exercise  control  over,  for  example,  the 

intelligence  data  that  were  being  made  available  and  fed  from  external  agencies  or 
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databases,  otherwise  known  as  other  systems,  into  the  system.  Similarly,  if  a  passenger 
with  security  defects  was  detected  and  potentially  traced  or  linked  to  other  individuals  or 
organizations  residing  physically  outside  the  airport  boundaries  or  the  passenger  security 
system  boundaries,  the  passenger  security  system  would  then  hand  over  the  investigation 
and  pursuit  of  these  linkages  to  the  detected  defects  to  other  law  enforcement  agencies 
(i.e.,  external  systems).  This  behavior  is  expected  from  a  system  as  compared  to  a 
passenger  security  SoS  that  would  otherwise  trigger  other  SoS  elements  to  follow  up. 

This  thesis  took  a  systematic  analysis  of  the  aviation  system  with  a  specific  focus 
on  the  airport  passenger  security  system  scrutinizing  the  passenger  (as  mereological 
objects)  to  pin-point  possible  gaps  and  vulnerabilities  that  could  be  potentially  exploited 
by  malicious  parties,  and  thereby  identify  approaches,  means  or  even  measures  to 
safeguard  and  counter  against  these  risks.  This  analysis  would  include  the  exploration  of 
trade  space  between  the  different  entities  within  the  system  and  the  interactions  between 
objects,  functions,  processes  and  its  associated  results.  A  systems  engineering  (SE) 
process  premised  on  problem  solving  that  is  iterative,  recursive  and  illative  was  adopted. 

This  thesis  adopted  the  following  structure:  Chapter  I  discusses  the  background 
and  basis  for  the  thesis;  Chapter  II  examines  the  current  U.S.  aviation  security  system  and 
principles;  Chapter  III  discusses  the  use  of  the  supply  chain  as  a  model  to  view  airport 
passenger  security,  relating  supply  chain  characteristics  to  the  airport  security  model  and 
analysis;  Chapter  IV  identifies  the  limitations  in  existing  security  systems  as  problems 
that  need  to  be  solved  through  an  SE  process  involving  the  use  of  tools  such  as  functional 
decomposition,  functional  flow  block  diagram  and  evaluative  functional  analysis.  It  also 
discusses  the  conceptualization  of  improvements  (or  solutions)  to  these  identified 
problems;  Chapter  V  discusses  the  development  of  a  risk  index  (RI)  as  a  form  of  defect 
assessment  within  the  supply  chain;  and  Chapter  VI  discusses  the  improvements  to 
passenger  security  system  arising  from  the  thesis  research  and  identifies  areas  for 
subsequent  research. 
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E.  SCOPE 


The  scope  of  this  thesis  is  to  investigate  the  passage  of  passengers  through  airport 
security.  The  broader  scope  that  involves  discussion  of  boundaries  beyond  the  airport 
physical  structures  and  perimeter  are  included  as  part  of  the  movement  of  passengers 
through  the  functional  and  behavioral  boundaries  of  the  airport. 

F.  RESEARCH  QUESTIONS 

The  thesis  utilizes  the  following  questions  as  a  guiding  tool  in  laying  out  the 
content. 

•  What  are  the  (new)  possible  security  measures  or  processes  (resulting 
from  the  analysis  of  interactions)  that  airport  security  authorities  could 
possibly  consider  to  help  further  their  view  of  security? 

•  How  do  the  (new)  potential  measures  compare  to  existing  security 
procedures/measure  s  ? 

•  Can  the  supply  chain  model  of  viewing  passengers  as  goods  be  used  in  the 
analysis  of  the  airport  passenger  security? 

•  Can  the  methodological  approach  of  analysis  provide  a  new  perspective 
(new  way  of  doing  things)  on  airport  passenger  security? 
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II.  UNITED  STATES  AVIATION  SECURITY  SYSTEM 


A.  OVERVIEW 

This  chapter  examines  the  existing  U.S.  aviation  security  system.  The  current 
aviation  security  system  is  based  on  a  defense-in-depth  approach  which  implies 
sequential  and  layered  mechanisms  that  enact  security  functions  to  increase  state  of  being 
free  from  danger  or  threat. 

•  The  principle  of  sequential  mechanisms  can  be  stated  as:  sequential 
mechanisms  provide  a  higher  degree  of  reciprocity  between  objects.  The 
greater  the  number  of  interactions  between  objects,  the  higher  the 
reciprocity  by  which  objects  learn  more  about  each  other. 

•  The  principle  of  layered  mechanisms  can  be  stated  as:  overlapping 
mechanisms  validate  the  failure  of  one  or  more  of  the  overlapped 
mechanism(s).  The  greater  the  overlap  of  the  mechanisms,  the  higher  the 
situational  awareness. 

In  the  context  of  this  thesis,  the  security  risks  or  threats  that  are  being  detected  by 
mechanisms  are  also  known  as  security  defects.  Security  defects  are  defined  as  anomalies 
in  security  which  may  result  in  a  loss  of  life,  material  or  information.  Examples  include 
(1)  acts  or  behaviors  by  individuals  which  contravene  security  rules  and  procedures,  (2) 
materials  or  artifacts  that  do  not  conform  to  security  requirements  and  (3)  information 
provided  that  does  not  reconcile  with  security  guidelines.  The  detection  of  defects  would 
save  lives  and  minimize  damage;  and  the  greater  the  distance  and  time,  the  higher  the 
probability  of  detecting  defects.  As  depicted  in  Figure  1,  the  multi-layered  security  is 
enacted  through  a  sequence  of  overlapping  security  mechanisms  that  provide  validation 
and  verification  of  performance  as  well  as  time  to  detect,  evaluate  and  respond  to  threats. 
The  different  phases  in  the  passenger  flow  from  arrival  to  departure  depict  the  sequential 
mechanisms,  while  the  layered  mechanisms  arise  from  the  multiple  layers  of  security,  for 
example,  at  the  passenger  security  screening  checkpoints  consisting  of  front-line  TSA 
checkers,  a  second  layer  of  supervision  and  a  third  layer  of  oversight  coming  from  the 
command  center  through  the  surveillance  mechanisms. 
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Figure  1.  Sequential  and  Layered  Mechanisms  Enacting  Security  Functions  (Adapted 

from  TS A,  2013c). 


1.  Definition  of  Terms 

•  Function  is  defined  as  “specific  or  discrete  action  (or  series  of  actions)  that 
is  necessary  to  achieve  a  given  objective;  that  is,  an  operation  that  the 
(security)  system  must  perform...”  (Blanchard  &  Fabrycky,  2011).  It  can 
also  be  seen  as  “an  action  that  is  realized  when  objects  interact” 
(Fangford,  2012). 

•  Sequential  is  defined  as  a  systematic  series  of  steps,  activities  or  processes 
that  objects  would  flow  through  in  an  airport  passenger  security  system. 

•  Reciprocity  is  defined  as  interactions  and  exchanges  of  EMMI  between 
objects. 

•  Object  (airport  object  or  passenger  as  an  object)  is  defined  “as  a 
fundamental  element,  entity,  or  representation  . . .  Objects  have  boundaries 
and  may  be  comprised  of  other  objects,  each  of  which  is  related  by 
interactions”  (Fangford,  2012). 

•  Interaction  is  defined  “as  the  transfer  of  EMMI.  Interaction  is 
characterized  by  the  transfer  of  something  from  one  object  (sender)  to 
another  object  (receiver)”  (Fangford,  2012). 

•  “Mechanisms  are  the  means  by  which  objects  and  processes  change.  The 
effect  of  a  mechanism  is  to  transform  an  input  EMMI  into  an  output 
EMMI.  A  mechanism  is  that  which  operates  in  the  context  of  force” 
(Fangford,  2012). 
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•  Overlapped  mechanisms  provide  partial  coverage  of  the  same  area  of 
(security)  function,  or  purpose,  serving  as  back-up  to  the  original  function, 
or  purpose. 

•  Situational  awareness  is  defined  as  the  conscious  and  knowledge  of  being 
aware  of  the  activities  or  occurrence  of  events  within  the  boundaries  of  an 
object  or  entity  in  context  of  the  airport  security  system. 

•  Validation  is  “the  process  of  demonstrating  the  effectiveness  of  service 
(security)  through  an  assessment  of  the  operational  system  that  exposes 
and  quantifies  the  systems’  limitations”  (Langford,  2012). 

•  Verification  is  “the  process  of  confirming  the  truth  or  accuracy  by 
describing  the  characteristics  of  interactions,  the  enactments  of 
mechanisms  or  procedures,  or  the  consequences  of  EMMI”  (Langford, 
2012). 

•  “Performance  is  the  action  associated  with  a  (security)  function. 
Performance  is  measured  by  the  extent  to  which  various  standards  are 
met”  (Langford,  2012). 

B.  U.S.  AVIATION  SECURITY  MODEL4 

The  Transportation  Security  Administration  (TSA)  has  adopted  a  layered  security 
concept  for  its  transportation  system,  which  includes  the  aviation  system.  This  concept 
uses  multiple  layers  of  security,  each  serving  a  different  purpose  but  cumulatively  serving 
the  common  intention  of  stopping  a  terrorist  attack,  as  shown  in  Figure  2  (TSA,  2013c). 
Note:  in  this  thesis,  the  different  layers  of  security  are  interpreted  as  representing 
different  roles  and  implying  distinguishable  responsibilities.  With  a  combination  of 
security  layers,  the  combined  security  effect  is  multiplied,  creating  a  more  secure  aviation 
system.  With  a  total  of  20  layers  of  security  in  place,  the  terrorist  would  need  to  find  gaps 
in  each  layer  and  overcome  the  combined  effect  of  the  layers  to  have  any  chance  of 
carrying  out  a  successful  attack.  These  different  layers  can  be  categorized  generally  by 
type  and  location  of  layers.  The  broad  categories  are:  1)  Intelligence,  2)  Security  Checks 
and  Inspections  at  airports  and  3)  Security  Measures  on  board  aircraft. 


4  A  study  presented  by  Fletcher  (2011)  served  as  a  basis  of  reference  for  this  section. 
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Figure  2.  Twenty  Different  Layers  of  Security  (Adapted  from  TSA,  2013c). 


Similar  to  other  security  models,  intelligence  activities  form  one  of  the  first  layers 
in  aviation  security.  Intelligence  for  aviation  security  is  being  fed  into  the  system  from 
various  information  sources  within  the  U.S.  intelligence  community.  These  sources 
include  agencies  such  as  the  Federal  Bureau  of  Investigation  (FBI)  and  the  National 
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Counterterrorism  Center  (NCC).  In  addition,  this  information  is  regularly  supplemented 
by  other  sources  of  intelligence  supplied  to  the  United  States  by  its  Coalition  partners, 
and  collectively  these  form  the  intelligence  picture  for  aviation  security.  Besides 
providing  valuable  information  for  the  aviation  security  system  to  support  proactive 
planning  and  preparation  against  potential  threats,  it  also  serves  as  a  basis  of  reference  for 
the  TSA  Secure  Flight  Program.  Under  the  Secure  Flight  Program,  travelers  are  required 
to  submit  additional  personal  information5  to  the  airline  when  they  reserve  or  purchase 
their  tickets.  The  airline  in  turn  submits  the  information  to  Secure  Flight,  which  uses  it  to 
perform  watch  list  matching  based  on  its  existing  database  which  is  supported  by  the 
intelligence  picture.  The  aim  is  to  deny  individuals  identified  on  the  “No  Fly  List”  from 
boarding  an  aircraft  and  to  identify  individuals  on  the  “Selectee  List”  for  additional 
screening  before  allowing  them  to  board.  After  the  completion  of  watch  list  matching, 
Secure  Flight  then  transmits  the  results  back  to  airlines  so  they  can  issue  passenger 
boarding  passes  accordingly  (TSA,  2013f). 

Moving  from  the  intelligence  layers  into  the  security  checks  and  inspections 
layers,  individuals  and  their  belongings  could  be  subjected  to  a  series  of  scheduled  or 
random  security  checks  and  inspections  at  the  airport. 

TSA  has  taken  a  risk-based  approach  in  its  screening  procedures  based  on 

the  following  premises:  (TSA,  2013e). 

•  “The  majority  of  airline  passengers  are  low  risk. 

•  By  having  passengers  voluntarily  provide  more  information  about 
themselves,  TSA  can  better  segment  the  population  in  terms  of  risk. 

•  Behavior  detection  and  interviewing  techniques  should  be  strengthened  in 
the  screening  process. 

•  TSA  must  accelerate  its  effort  to  optimize  screening  processes  and  use  of 
technology  to  gain  system-wide  efficiencies. 

•  Increase  security  by  focusing  on  unknowns;  expedite  known  and  trusted 
travelers.” 


5  Known  as  Secure  Flight  Passenger  Data  (SFPD),  it  includes  full  name,  date  of  birth,  gender  and 
redress  number  (TSA,  2013f). 
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All  checked  baggage  in  the  United  States  has  been  subjected  to  100%  screening  since 
December  2003  under  TSA’s  Electronic  Baggage  Screening  Program  (EBSP)  that  uses 
Explosive  Detection  System  (EDS)  equipment  and  Explosives  Trace  Detector  (ETD) 
devices  as  the  primary  screening  technologies  to  identify  potentially  hazardous  baggage 
(Kane,  2009).  All  traveling  individuals  are  required  to  present  themselves  with  the 
appropriate  travel  documents  and  personal  identification  papers  to  the  Travel  Document 
Checker  (TDC)  to  commence  the  scheduled  security  checks  and  inspections.  At  the 
station,  the  presented  documents  are  checked  for  authenticity  together  with  the  checking 
of  passengers’  identities  against  a  valid  boarding  pass  to  prevent  any  fraudulent  use  by 
any  other  individual  to  gain  access  to  the  concourse  area  and  subsequently  to  the  aircraft. 
Since  October  2011,  TSA  has  also  started  a  pilot  program  on  the  use  of  document 
verification  technology,  known  as  Credential  Authentication  Technology-Boarding  Pass 
Scanning  Systems  (CAT-BPSS)  to  identify  fraudulent  identity  documents  and 
authenticate  boarding  passes  efficiently  and  effectively  (TSA,  2012).  Beyond  the  TDC 
stage,  passengers  are  directed  to  one  of  the  lines  for  checks  and  inspections  of  carry-on 
bags  and  personal  belongings  through  X-ray  machine  checks  by  TSA  officers.  Passengers 
are  subjected  to  screening  by  walking  through  a  metal  detector  or  through  Advanced 
Imaging  Technology  (AIT)6.  In  addition,  a  series  of  security  technologies  and  procedures 
are  employed  in  this  stage  of  scheduled  checks  and  inspection  to  aid  in  the  identification 
of  prohibited  items7.  This  equipment  includes  bottled  liquids  scanners  to  detect  potential 
liquid  or  gel  threats,  CastScope  to  ensure  that  a  cast  or  prosthetic  does  not  contain 
concealed  threat,  explosive  trace  detection  to  screen  for  traces  of  explosives,  and  TSA’s 
3-1-18  for  carry-ons.  Besides  the  scheduled  checks  and  inspections,  random  checks  and 
inspections  are  also  conducted  at  any  time  from  the  moment  an  individual  enters  the 
airport  premises  until  he/she  boards  the  aircraft.  These  inspections  are  carried  out  by  the 

6  Imaging  technology  screening  is  optional  for  all  passengers.  Passengers  who  do  not  wish  to  receive 
imagining  technology  screening  will  receive  alternative  screening,  including  a  physical  pat-down  (TSA, 
2013,  May  21). 

7  The  latest  TSA  Prohibited  Items  list  can  be  accessed  via 
http://www.tsa.gov/sites/default/files/assets/pdf/prohibited_items_brochure_0.pdf 

8  This  includes  a  3.4  ounce  (100ml)  bottle  or  less  (by  volume);  1  quart-sized,  clear  plastic,  zip-top  bag; 
1  bag  per  passenger  placed  in  screening  bin.  One-quart  bag  per  person  limits  the  total  liquid  volume  each 
traveler  can  bring.  3.4  ounce  (100ml)  container  size  is  a  security  measure  (TSA,  2013,  July  3). 
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Visible  Intermodal  Prevention  and  Response  (VIPR)  team  to  detect  and  respond  to 
potential  security  threats,  explosive  detection  canine  teams,  and  Screening  of  Passengers 
by  Observation  Techniques  (SPOT)  program.  The  SPOT  program  served  to  observe 
normal  passenger  characteristics  and  anxieties  and  to  identify  anomalies  for  detecting 
individuals  who  may  be  a  security  threat  to  the  aviation  system  (Hawley,  2006).  Detected 
threats  are  subject  to  additional  screening  and  checks  In  addition,  TSA  has  also 
implemented  the  Bomb  Appraisal  Officers  (BAOs)  program  to  prevent  explosives  and 
IEDs  from  being  introduced  into  the  aviation  system  and  provide  on-site  assistance  to 
resolve  suspected  alarms.  These  layers  are  augmented  by  a  comprehensive  network  of 
surveillance  cameras  that  provide  live  images  and  video  coverage  on  activities  within  the 
aviation  system  in  support  of  security. 

The  final  layers  of  security  are  those  on  board  the  aircraft.  These  are  aimed  at 
safeguarding  the  flight  and  its  passengers  from  any  threat  that  was  not  detected  and 
eradicated  by  the  previous  layers.  These  layers  comprise  of  the  federal  air  marshal  service 
which  places  trained  air  marshals  on  board  a  flight.  Air  marshals  provide  an  added 
measure  of  security  resulting  from  threat  information  and  intelligence,  vulnerabilities  and 
consequence9  (Lord,  2009),  when  the  flight  is  on  route  to  its  destination.  The  federal 
flight  deck  officers  program  authorizes  eligible  flight  crewmembers10  to  use  firearms  to 
defend  against  acts  of  criminal  violence  to  gain  control  of  an  aircraft.  Trained  flight  crew 
assist  in  handling  security  incidents  that  happen  on  board  an  aircraft.  Moreover,  law 
enforcement  officers  may  be  on  board  the  flight,  hardened  cockpit  doors  may  be  in  place 
to  prevent  unauthorized  access  to  the  flight  deck  and  passengers  are  at  heightened 
awareness  should  they  need  to  act. 

These  different  layers  of  security  (i.e.,  different  roles  and  responsibilities  for 
security  personnel)  constantly  evolve  and  are  updated  to  address  emerging  threats  as  a 
result  of  improvements  to  existing  measures.  Associated  with  these  roles  and 
responsibilities  are  changes  in  security  procedures  and  measures  to  handle  the  threats,  or 
new  approaches  and  technologies  that  improve  detection  capabilities  of  prohibited  items. 

9  The  exact  deployment  criteria  of  air  marshals  on  board  flights  are  not  openly  available. 

1 0  A  flight  crew  member  may  be  a  pilot,  flight  engineer  or  navigator  assigned  to  the  flight. 
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An  example  of  these  evolving  improvements  is  the  numerous  screening  initiatives11 
introduced  by  TSA  over  recent  times  to  align  to  risk-based  security  more  effectively.  The 
various  security  measures  as  described  in  the  existing  aviation  system  can  be  depicted  in 
a  model  of  U.S.  aviation  security,  shown  in  Figure  3. 
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Figure  3.  U.S.  Aviation  Security  Model  (Adapted  from  Fletcher,  201 1). 


1 1  These  include  “TSA  Pre  /™  Expedited  Screening,  Screening  for  Active  Duty  U.S.  Service 
Members,  Screening  for  Passengers  12  and  Under,  Screening  for  Passengers  75  and  Older,  Managed 
Inclusion.”  (TSA,  2013,  March  14). 
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The  measures  in  the  security  model  (Figure  3)  are  as  follows: 


Intelligence  layers 

•  Intelligence  and  Secure  Flight  program 

Security  checks  and  inspection  layers 

•  Visible  intermodal  prevention  and  response  team,  canine  teams 
and  SPOT  program 

•  Security  checkpoints  (travel  document  checker,  walk-through 
metal  detector,  advanced  imaging  technology,  X-ray  screening  of 
carry-on  bags  and  personal  belongings,  bottled  liquid  scanners, 
CastScope  checks,  explosive  trace  detection,  Bomb  Appraisal 
Officers  program) 

•  Electronic  Baggage  Screening  Program 

Onboard  layers 

•  Federal  air  marshal  service,  federal  flight  deck  officers  program, 
trained  flight  crew,  law  enforcement  officer,  hardened  cockpit 
door,  passengers 
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III.  SUPPLY  CHAIN  MODEL 


This  section  discusses  the  use  and  relevancy  of  the  supply  chain  model  in  the 
context  of  defects  detection  in  airport  passenger  security  system.  Bozarth  and  Handfield 
(2006)  defined  supply  chain  as  “a  network  of  manufacturers  and  service  providers  that 
work  together  to  convert  and  move  goods  from  the  raw  materials  stage  through  to  the  end 
user.”  Supply  chain  management  can  been  seen  as  a  form  of  SoS  architecture  with 
different  entities  interacting  at  the  various  levels  and  phases  with  the  aim  of  improved 
product,  reduced  cost  and  reduced  time  required  to  deliver  the  product.  With  the  aim  of 
on  time  delivery  of  the  required  amount  of  goods  to  the  customer,  one  of  the  specific 
features  of  best  value  supply  chains  is  the  supply  chain  information  systems  (Ketchen, 
Rebarick,  Hult,  and  Meyer,  2008).  This  information  system  includes  the  ability  to  have 
almost  real-time  monitoring  and  tracking  of  goods  status,  demand  and  inventory  within 
the  supply  chain.  While  the  supply  chain  model  can  serve  as  a  basis  to  examine  and 
possibly  reduce  costs,  and  to  shorten  the  time  through  security,  the  intent  of  its  use  in  this 
thesis  is  to  focus  on  managing  risk.  The  aviation  system  can  be  seen  as  a  large  supply 
chain  composed  of  a  network  of  service  providers  in  the  form  of  airports  transporting  and 
moving  people  to  their  final  destinations.  Similarly,  airport  passenger  security  can  be 
seen  as  a  supply  chain  model  to  move  and  deliver  people  as  goods  through  security 
checks  to  their  respective  aircraft.  The  analogy  is  for  the  people  to  pass  through  various 
phases  in  the  supply  chain,  with  each  phase  being  the  means  of  detecting  security  defects 
in  the  “goods.”  The  purpose  is  to  have  a  flow  of  goods  through  the  supply  chain  in  a 
timely  fashion  with  the  end  state  of  delivering  defect-free  passengers  with  the  appropriate 
certification  of  security  at  the  doorstep  of  each  outbound  aircraft.  As  the  goods  progress 
through  the  supply  chain,  testing  will  be  conducted  to  ensure  conformance  to  security 
requirements. 

A.  CHARACTERISTICS  OF  THE  SUPPLY  CHAIN  MODEL 

The  supply  chain  model  can  be  seen  as  an  integrated  process  involving  different 
entities  that  transform  sourced  raw  materials  into  finished  products  for  customers.  As 
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defined  by  Beamon  (1998),  “a  supply  chain  is  comprised  of  two  basic,  integrated 
processes:  (1)  the  production  planning  and  inventory  control  process,  and  (2)  the 
distribution  and  logistics  process,  providing  the  basic  framework  for  the  conversion  and 
movement  of  raw  materials  into  final  products.”  As  implied  by  the  definition,  integrated 
processes  can  be  seen  as  one  of  the  key  characteristics  of  a  supply  chain  model.  The 
integrated  supply  chain  is  the  outcome  of  interactions  between  the  different  processes 
supporting  the  various  phases  of  a  supply  chain  in  the  production  and  delivery  of  the  final 
product.  In  the  context  of  aviation  travel,  integrated  processes  exist  with  different  entities 
each  having  their  own  procedures  and  processes,  interacting  together  to  support  the 
transportation  of  passengers  to  their  respective  destinations.  Similarly,  within  the  aviation 
travel  system,  the  airport  passenger  security  system  can  be  seen  to  possess  integrated 
processes  working  toward  providing  safe  transportation  for  all  passengers. 

Another  characteristic  of  the  supply  chain  model  is  the  use  of  information  and 
communication  technology  (ICT).  Kollberg  and  Dreyer  (2006)  considered  ICT  to  be  “a 
key  enabler  for  supply  chain  management  through  its  ability  to  support  information 
sharing  and  shortening  information  processing  time.”  The  harnessing  of  ICT  in  the 
supply  chain  can  provide  instant  information,  forecasting  and  replenishment  knowledge 
(Lee,  2000),  thereby  improving  situational  awareness  and  facilitating  informed  decision 
making.  This  concept  of  monitoring  and  tracking  goods  and  the  status  of  the  supply  chain 
is  likewise  applicable  in  the  context  of  the  airport  passenger  security  system.  The  status 
(defective  or  not  defective)  and  risk  profile  of  each  individual  passenger  can  be  tracked  in 
real-time  as  he/she  flows  toward  the  aircraft,  providing  up-to-date  information  to  security 
agencies  for  the  type  of  security  measures  or  procedures  to  activate.  Information  and 
knowledge  on  individual  goods,  traffic  patterns  at  different  airports  and  at  different  times 
of  the  year  can  further  be  collated  into  trends  and  databases  providing  valuable 
knowledge  for  the  purpose  of  goods  profiling  and  subsequent  referencing. 

Quality  conformance  is  the  other  characteristic  of  the  supply  chain  model  that  is 
of  relevance  to  the  airport  passenger  security  system.  Bozarth  and  Handfield  (2006) 
identified  “number  of  defects”  and  “number  of  mistakes”  as  possible  measures  of  quality 
conformance.  “A  defect  or  mistake,  by  definition,  means  that  the  product  or  service  failed 
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to  meet  specifications”  (Bozarth  &  Handfield,  2006).  There  is  a  need  to  understand  the 
dimensions  of  quality  that  are  important  to  users  and  incorporate  the  appropriate 
processes  within  the  supply  chain  model  to  meet  users’  requirements.  In  the  case  of  the 
airport  passenger  security  system,  the  requirement  of  having  defect-free  passengers  at  the 
doorstep  of  each  aircraft  drives  the  processes  and  measures  required  to  detect  defects  in 
passengers  at  any  point  within  the  supply  chain. 

B.  AIRPORT  PASSENGER  SECURITY  MODEL 

The  model  for  integrated  security  assumes  airport  passengers  participate  and  can 
be  represented  as  goods  in  the  supply  chain.  Each  physical  object  in  the  supply  chain  is 
identified  with  a  risk  index  that  can  change  with  context  and  environment.  This  risk  index 
is  equivalent  to  the  measure  of  defects  within  the  notion  of  goods  to  be  moved.  As  the 
goods  progress  through  the  supply  chain  toward  the  end  of  production,  they  undergo 
various  checks  and  tests  to  measure  the  defect  level  of  the  goods  as  part  of  the  supply 
chain  quality  control  process.  Goods  that  pass  the  quality  control  checks  will  be 
delivered,  while  goods  that  do  not  meet  the  quality  standards  (with  an  RI  exceeding  the 
defect  threshold)  would  be  rejected.  Given  the  growing  importance  of  situational 
awareness,  the  model  focuses  on  real-time  monitoring  and  tracking  characteristics  of  the 
supply  chain  to  monitor  and  track  defects  in  the  goods  so  that  the  movement  of  people  to 
the  aircraft  can  be  presented  to  the  crew  of  the  aircraft  as  defect-free  goods.  This  process 
would  include  the  identification  and  testing  of  defects  (suspected  or  identified  flaws)  in 
the  goods  across  the  different  phases,  as  part  of  the  supply  chain.  An  example  of  such 
real-time  tracking  and  monitoring  of  passengers  once  they  enter  the  boundaries  of  the 
airport  system  is  Project  SAMURAI  (Suspicious  Abnormal  Behavior  Monitoring  Using  a 
netwoRk  of  cAmeras  &  sensors  for  situational  awareness  enhancement)  (Centre  for 
Strategy  &  Evaluation  Services,  2011).  Defects  measured  in  the  form  of  an  RI  that  would 
be  assigned  to  every  good  that  is  bound  for  air  travel.  Depending  on  the  activities, 
interactions  and  outcomes,  the  RI  would  vary  as  goods  flow  through  the  different  phases 
of  the  model.  The  RI  and  its  changing  profile  would  be  tracked  and  monitored  in  real¬ 
time  over  the  phases  to  determine  if  the  final  goods  to  be  loaded  onto  the  aircraft  are 
within  the  acceptable  defect  threshold. 
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While  the  concept  of  RI  will  be  discussed  in  greater  detail  in  Chapter  V,  at  this 
point  RI  can  be  broadly  categorized  as  Low,  Medium  or  High.  Anyone  who  boards  any 
mode  of  transportation  with  an  end  terminal  at  the  airport  would  be  assigned  a  low  RI. 
Someone  who  disembarks  before  reaching  the  airport  would  have  his/her  RI  reset  and  the 
relevant  information  stored  and  archived.  Depending  on  the  exhibited  actions,  behavior 
and  interactions  during  the  trip  or  over  multiple  trips  towards  the  airport,  the  RI  of  the 
individual  would  vary.  When  the  RI  exceeded  the  TEST  threshold,  the  individual  would 
be  tested  through  built-in  tests  along  the  phases.  The  RI  level  can  be  a  reduced,  increased 
or  maintained  RI  depending  on  responses  and  observations  during  testing  (e.g., 
nervousness,  dry  mouth)  and  the  outcome  of  testing.  While  an  unclear  act  may  result  in  a 
maintained  RI,  a  suspicious  act  would  definitely  increase  one’s  RI.  The  RI  and  its  profile 
would  be  tracked  and  monitored  in  real  time  for  decision  making,  which  could  mean 
going  through  other  testing  or  even  being  refused  final  clearance  to  board  the  aircraft. 
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IV.  INTEGRATIVE  FUNCTIONAL  ANALYSIS 


Integrative  functional  analysis  is  a  method  that  shows  how  interactions  between 
objects  result  in  functions  that  help  describe  the  potential  uses  of  an  object  or  system 
(Langford,  2012).  This  method  is  premised  on  a  systematic  approach  to  analyzing  the 
consequences  of  interactions  between  objects  that  comprise  another  object,  system  or 
system  of  systems.  Through  the  technique  of  decomposing  functions  into  sub  functions, 
the  partitioning  of  objects  into  modules  that  comprise  single  inputs  and  output,  and  the 
interactions  between  modules  of  each  object  to  be  analyzed,  this  method  provides  a 
framework  to  sift  through  processes  and  procedures  to  identify  potential  areas  of 
improvement. 

A.  SYSTEM  BOUNDARIES 

The  airport  system  comprises  many  different  objects  and  each  of  these  objects  has 
its  own  set  of  unique  boundaries  evolving  around  how  the  object  would  exist  on  its  own 
within  the  system  or  interact  with  other  objects  as  part  of  the  airport  system.  As  part  of 
the  analysis  of  the  airport  system,  the  study  of  the  system  boundaries  provides  insights 
into  the  characteristics  of  the  system  and  an  additional  dimension  of  the  problem  at  hand. 
A  change  in  boundary  conditions  could  result  in  emergence  that  impacts  the  entire 
system.  For  example,  allowing  the  carrying  of  pocket  knives  on  board  a  flight  (Ahlers, 
2013)  would  have  an  impact  on  overall  system  operations  and  the  interoperability  of  all 
constituent  systems  especially  if  the  change  in  policy  runs  contrary  to  existing  state  law 
(Durkin,  2013). 

1.  Behavioral,  Functional  and  Physical  Boundaries 

People  bound  for  air  travel  will  pass  through  defined  boundaries  and  domains  as 
they  make  their  way  to  departure  gates  and  boarding  areas.  These  boundaries  and 
domains  are  the  behavioral,  functional  and  physical  aspects  of  limitations  that 
characterize  travel  to  board  aircraft. 
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a. 


Behavioral  Boundary 


Generally,  transportation  lines  to  the  airport  are  planned  and  designed  to 
terminate  at  the  airport  with  the  airport  being  either  the  final  destination  or  starting  point 
for  the  airport  system.  These  lines  can  be  in  the  form  of  a  road  network,  railway  tracks  or 
even  pedestrian  walkways.  People  on  the  various  modes  of  transportation  on  these  lines 
may  be  bound  for  all  possible  destinations  that  are  linked  or  interconnected  to  the  lines. 
People  bound  for  different  destinations  with  various  purposes  may  behave  and  act 
differently  on  each  of  these  transportation  lines.  The  behavioral  boundary  signifies  the 
behavioral  perimeter  where  the  airport  system  functions  and  objects  influence  the 
behavior  of  the  individuals  who  are  traveling  to  the  airport.  This  is  the  point  beyond 
which  the  behaviors  observed  of  the  remaining  individuals  on  the  transportation  lines 
would  be  similar  to  those  of  all  people  going  to  the  airport  even  though  they  may  be 
traveling  to  the  airport  for  different  purposes,  such  as  working  at  the  airport  and  traveling 
as  a  passenger.  This  behavioral  boundary  also  serves  as  the  boundary  where  the  intention 
of  all  remaining  individuals  on  the  transportation  lines  becomes  clear  that  they  are  all 
bound  for  the  airport.  The  context  and  perspective  of  the  travelers  serve  to  identify 
behavioral  boundaries. 

b.  Functional  Boundary 

Functional  boundaries  are  formed  at  the  interface  of  objects  due  to  the 
interactions  of  objects  (Langford,  2012).  In  the  airport  system,  functional  boundaries  are 
determined  by  interactions  between  the  objects  of  transportation  that  link  the  airport  and 
individuals  using  them.  For  individuals  with  a  perspective  of  going  to  the  airport,  any 
embarkation  point  on  the  transportation  lines  (be  it  a  bus  stop,  a  train  station  or  any  point 
along  the  way)  signifies  the  functional  boundary  of  the  function  of  ‘to  transport’  as 
signified  by  “going  to  the  airport.”  In  essence,  the  functional  boundary  of  the  airport 
system  is  a  function  of  interactions  between  objects  residing  both  within  and  outside  the 
system  and  can  change  depending  on  the  dynamics  of  interactions  between  the  objects. 
The  traveler’s  use  or  lack  of  use  of  the  objects  associated  with  and  comprising  the 
transportation  links  identify  the  functional  boundaries. 
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c. 


Physical  Boundary 


Physical  objects  can  be  thought  of  as  the  exterior  perimeter  of  a  solid 
object,  a  network  of  physical  objects,  and  structures  with  holes,  voids  and  gaps.  The 
structures  may  be  rigid  or  flexible  or  small  or  large  (Langford,  2012).  In  the  context  of 
the  airport  system,  the  domain  of  “close  proximity”  signifies  the  physical  perimeter 
boundary  of  the  airport  system.  The  corporeal  boundary  can  also  be  conveniently 
considered  and  used  as  the  extended  physical  boundary  of  the  airport  passenger  security 
system. 

B.  AIRPORT  PASSENGER  SECURITY  SYSTEM  AS  A  SUPPLY  CHAIN 

MODEL 

The  airport  passenger  security  system  can  be  thought  of  as  the  supply  chain  in  a 
manufacturing  model;  it  moves  and  delivers  people  (passengers)  as  goods  through 
security  checks  to  the  respective  flights.  The  analogy  is  for  the  people  to  pass  through 
various  phases  in  the  supply  chain,  with  each  phase  being  the  means  of  detecting  security 
defects12  in  the  “goods.”  Security  errors  are  defined  as  mistakes  committed  by 
individuals  intentionally  or  unintentionally  which  could  potentially  result  in  downstream 
security  defects.  Defective  individuals  are  defined  as  individuals  who  deliberately 
commit  a  security  error  or  contribute  to  a  security  defect.  In  the  airport  passenger  security 
system,  security  defects  can  be  associated  with  passengers  or  carry-on  items  or 
belongings,  i.e.,  objects,  functions  and  behaviors.  The  aim  is  to  have  a  smooth  flow  of 
goods  through  the  supply  chain  in  a  timely  manner  with  the  end  state  of  delivering 
defect-free13  passengers  with  the  appropriate  certification  of  security  at  the  doorstep  of 
each  outbound  aircraft.  As  the  goods  progress  through  the  supply  chain  that  is  grounded 
in  the  physical  world  of  objects  (i.e.,  physical  locations  are  used  to  inventory  or  inspect 
the  progress  of  goods  through  a  sequence  of  physical  objects;  for  example,  checkpoints, 
can  be  considered  a  like-kind  equivalent  for  security  at  airports),  testing  will  be 
conducted  to  ensure  conformance  of  security  requirements. 


12  Refer  to  Chapter  2  for  the  definition  of  security  defects. 

13  Defect-free  is  being  equated  to  having  a  security  RI  that  is  acceptable  to  the  security  authorities. 
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1.  Passenger  Physical  Flow  in  Airport  System 

Anyone  with  the  intention  of  traveling  to  the  airport  would  need  to  board  one  of 
the  available  transportation  lines  to  make  their  way  to  the  airport.  As  the  individual 
travels  toward  the  airport,  he  would  enter  the  behavioral  boundaries  of  the  airport  system 
as  observed  through  the  exhibited  behavior  of  the  individual  traveling  to  the  airport.  The 
interactions  between  individuals  (who  are  to  be  or  are  bound  for  the  airport)  with  airport 
system  functions  or  other  individuals  (or  objects  related  to  air  travel  and  the  particulars 
that  distinguish  the  traveler)  would  determine  the  behavioral  boundaries  of  the  airport 
system.  The  interactions  between  the  individual  and  the  functions  of  the  transportation 
lines  would  determine  the  entry  into  the  functional  boundaries  of  the  airport  system  as  the 
individual  travels  beyond  doubt  toward  the  airport.  The  crossing  of  the  individual  into  the 
perimeter  boundary  of  the  airport  signifies  the  entry  into  the  physical  domain  of  the 
airport  system.  This  physical  flow  of  the  passenger  within  the  airport  system  is  as  shown 
in  Figure  4  and  discussed  in  the  following  sub-sections. 


Figure  4.  Movement  of  Passenger  through  Airport  System  Boundaries. 


a.  F.3.0  Airport  Domain 

On  entry  to  the  physical  domain  of  the  airport  system,  the  individual 
would  undergo  a  typical  physical  travel14  to  the  airport  departure  gates  as  shown  in 
Figure  5.  Individuals  arriving  at  the  airport  domain  (airport  building)  have  the  option  of 
commencing  the  required  travel  procedures  with  the  respective  airlines.  There  is  a 


14  While  there  could  be  other  passenger  flows  within  the  airport  domain,  for  example,  individuals 
transiting  at  the  airport  undergo  a  different  flow  process;  the  discussion  in  this  section  focuses  on  a  typical 
passenger  flow  in  the  airport  domain 
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presumed  expectation  by  the  airport  authority  and  security  that  passengers  who  travel  to 
the  airport  domain  involve  some  interest  in  the  functions  of  the  airport.  This  analysis  of 
airport  functions  will  be  discussed  in  greater  detail  under  the  decomposition  of  the  airport 
system. 


Figure  5.  Typical  Passenger  Flow  within  Airport  Domain  (Object  Movement  Route). 


(1)  F.3.1  Passenger  Drop  Off.  Regardless  of  the  mode  of 
transportation  used  to  commute  to  the  airport,  all  passengers  arriving  at  the  airport 
domain  would  generally  commence  their  movement  through  the  different  phases  (Figure 
5)  from  the  passenger  drop  off  area.  The  starting  point  could  be  the  vehicular  drop  off 
area  by  the  curbside,  the  train  station  platform,  or  the  bus  terminal  serving  shuttles. 
Passengers  residing  in  a  hotel  within  the  airport  domain  may  enter  the  system  via  other 
connection  means  such  as  internal  transit  system  or  even  by  foot. 

(2)  F.3.2  Enter  Airport  Building.  From  the  drop  off  point(s), 
passengers  would  enter  the  confines  of  the  main  airport  building  to  start  the  traveling 
procedures  as  required  by  airlines  and  airport  authorities. 

(3)  F.3.3  Go  to  Check-In  Point.  The  confirmation  of  an 
individual’s  intention  to  board  and  fly  on  the  scheduled  flight  could  be  performed  via  one 
of  the  many  means  available.  According  to  Delta  Air  Lines,  a  passenger  could  possibly 
adopt  one  of  the  five  different  ways15  to  check  in  on  any  given  traveling  day  (DELTA, 
2013).  With  different  airlines  having  varying  check-in  procedures,  individuals  who  have 
checked  in  online  could  potentially  proceed  straight  to  the  next  phase  of  security  checks 
upon  arriving  at  the  airport,  completely  bypassing  the  need  to  visit  any  airline  counter  or 
airport  kiosk.  Individuals  who  are  checking  in  at  the  airport  domain  would  need  to 


15  The  five  ways  are  (1)  to  check  in  physically  at  the  airline  counter,  (2)  online  check-in,  (3) 
Handphone  application  and  eBoarding  Pass,  (4)  physically  at  airport  kiosk  and  (5)  physically  at  airport 
curbside. 
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process  their  check-in  by  physically  going  to  one  of  the  check-in  points  available  within 
the  airport  domain. 

(4)  F.3.4  Go  Through  Security  Checkpoints.  Depending  on  the 
nature  of  the  travel  to  the  airport,  travelers  going  to  the  airport  for  different  purposes16 
undergo  various  forms  of  security  screening.  A  centralized  airport  passenger  security 
screening  has  been  implemented  for  all  traveling  individuals  to  identify  the  presence  of 
security  defects.  Checking  of  travel  documents,  inspection  of  individuals  through  the  use 
of  walk-through  detectors,  and  physical  inspection  of  carry-on  items  are  being  conducted 
here.  Besides  providing  a  physical  demarcation  for  a  security  boundary  within  the  airport 
domain,  separating  the  sterile  area  (commonly  known  as  the  concourse  area)  for  security 
screened  passengers  from  the  non-sterile  area  or  the  common  public  accessible  domain, 
this  centralized  security  screening  also  serves  as  a  zone  of  interaction  between  security 
screeners  and  the  traveling  passengers. 

(5)  F.3.5  Enter  Concourse  Area.  After  passing  through 
(“clearing”)  security,  passengers  could  move  through  hallways  connecting  the  concourse 
area  or  enter  the  concourse  area  directly,  leading  to  the  access  area  beyond  the  security 
checkpoints  to  their  respective  departing  gates.  This  sterile  area  is  an  out-of-bounds  area 
except  for  all  security  screened  passengers  and  the  relevant  support  personnel  working 
within  the  area. 

(6)  F.3.6  Go  to  Departure  Gates.  Within  the  concourse  area  are 
the  departure  gates.  The  final  access  points  to  the  respective  flights  are  defined  by  the 
doorway  to  the  aerobridge  connecting  the  aircraft  to  the  terminal  or  the  doorway  to  the 
tarmac  for  boarding  directly  from  tarmac.  Current  procedures  require  individuals 
traveling  through  airports  to  present  certain  types  of  documentation,  e.g.,  boarding  passes 
and  sometimes  photo  identification,  at  the  various  gates  for  boarding.  As  shown  in  Figure 
6,  a  typical  layout  of  the  above  listed  parts  make  up  the  whole  of  the  airport  security  and 
its  boundary  types. 


16  Some  examples  include  delivery  of  goods,  individuals  working  at  the  airport  within  the  concourse 
area,  aircraft  cleaners. 
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Figure  6.  Typical  Layout  of  Airport  Terminal  (“Terminal  Guide-Richmond 

International  Airport,”  n.d.). 


C.  DECOMPOSITION  OF  AIRPORT  FUNCTIONS  AND  PROCESSES 

Decomposition  of  airport  functions  and  processes  entails  breaking  down  the 
airport  system  into  its  constituent  functional  parts  to  facilitate  the  analysis  of  the  system 
and  the  interactions  of  the  objects  within  the  system. 

1.  Airport  Process  Decomposition 

While  the  airport  system  exists  to  serve  many  different  functions  within  its 
physical  boundaries,  the  focus  of  this  study  is  on  the  functions  and  processes  relevant  to 
the  passengers  as  stakeholders  in  the  analysis  of  the  airport  passenger  security  system. 
See  Figure  7  for  the  process  decomposition  of  the  airport  system. 
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2.  Passenger  Process  Decomposition 

As  each  stakeholder  has  a  significantly  different  perspective  of  the  airport  system 
and  the  system’s  requirements  (Buede,  2009),  each  of  them  will  behave,  interact  and 
response  differently  within  the  context  of  the  system  based  on  their  effective  needs  and 
motivation.  While  there  are  many  stakeholders  involved  in  the  airport  system,  the  focus 


17  There  are  other  processes  under  the  airport  system  that  are  reflected  as  since  they  are  not  be 
the  focus  of  this  decomposition. 
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on  passengers  within  the  system  is  predicated  on  the  intent  to  use  the  aircraft  as  a 
weapon.  The  process  flow  block  diagrams  in  Figures  8  to  13  depict  the  typical  passenger 
process  and  the  detailed  breakdown  of  its  associated  processes. 


Figure  8.  Typical  Passenger  Process  Flow  Block  Diagram. 


A  typical  passenger  in  the  airport  system  would  generally  perform  the  processes 
shown  in  Figure  8  as  part  of  the  airport  process  flow  to  get  on  board  a  scheduled  flight. 


Figure  9.  Check-in  Process. 


The  check-in  process  can  be  performed  through  one  of  the  five  possible  ways  by 
the  stakeholder  (in  this  instance,  the  passenger)  and  could  possibly  vary  between 
passengers  or  even  between  flights  by  the  same  passenger. 
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Figure  10.  Baggage  Check-In  Process. 


Depending  on  what  the  passenger  brings  along  for  the  flight,  he  has  the  ability  to 
perform  this  process  of  baggage  check-in  whenever  necessary. 


effbd  Security  Clearing  Process 
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Figure  11.  Clear  Security  Process. 
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All  passengers  would  be  mandated  to  perform  this  process  to  be  security  screened 
and  cleared  for  boarding  on  any  scheduled  flight. 


Figure  12.  Go  to  Boarding  Gate  Process. 


As  shown  in  Figure  12,  security  screened  passengers  would  either  wait  for  the 
departure  gates  to  be  opened  or  would  proceed  directly  to  board  if  boarding  has  already 
commenced  when  they  reached  the  departure  gates. 

Any  time  during  the  passenger’s  process  flow  within  the  airport  system,  the 
passenger  has  the  option  to  perform  any  activities  associated  with  the  “Fulfill 
Wants/Needs”  process  as  shown  in  Figure  13.  The  sub-processes  could  be  performed  by 
the  passenger  any  time  between  the  main  functions  that  he  undertakes  the  moment  he 
arrives  at  the  airport  domain  until  he  reaches  the  gate  to  board  the  scheduled  flight. 
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Figure  13.  Fulfill  Wants/Needs. 
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D.  INTERACTIONS  BETWEEN  OBJECTS  TO  CREATE  FUNCTIONS 

Objects  within  the  airport  system  interact  intimately  with  stakeholders  such  as  the 
passengers  since  the  airport  system  provides  services  through  its  functions  and  processes, 
and  passengers  use  these  services  to  meet  their  wants  and  needs.  This  section  examines 
and  discusses  the  results  of  some  of  the  core  interactions  between  the  objects  (and  their 
derived  functions)  within  the  airport  system  with  the  passenger  stakeholder. 

1.  Process  Passenger  Check-in  (airport  kiosk  perspective)  versus  Process 
Check-in  (Passenger  Perspective) 

The  airport  kiosk  serves  as  one  of  the  available  means  for  a  passenger  to  check  in 
for  a  scheduled  flight.  In  this  instance,  the  airport  kiosk  interacts  with  the  passenger  to 
provide  the  function  of  passenger  check-in  to  fulfill  the  passenger’s  check-in  function. 
See  Table  1  for  the  tabulation  of  the  results  of  the  interactions  between  the  objects  of 
airport  kiosk,  passenger  and  airport  building. 
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Table  1.  Results  of  Interactions  between  Functions  and  Processes  of  Airport  Kiosk, 

Passenger  and  Building. 


Airport  System 

Passenger 

Building 

Physical 

Object 

Function 

Process 

Physical 

Object 

Function 

Physical 

Object 

A  1.0  Kiosk 

1.2. 1.1  Process 

passenger 

check-in. 

2.2.2  Process 
Check-in. 

P1.0 

Passenger 

F1.0  Provide 
Support  (e.g., 
physical 
floor, 
lighting). 

B1.0 

Floor 

Results  of  Interactions 

Walk  up  to 
kiosk. 


Al.l 

Display 

Display 

menu/options. 

Select  check¬ 
in  option. 

A  1.2  Card 
Reader 

Transfer  card 
to  reader. 

Insert  credit 
card. 

Remove 
credit  card. 

Read  card. 

Transfer  card 
to  passenger. 

A1.3 

Check-in 

processing 

system 

Process  card 

information 

(match 

database, 

retrieve, 

display). 

A1.4 

Display 

Display 
passenger 
flight  details. 

Assess 

details. 

A1.3 

Check-in 

processing 

system 

Process  check¬ 
in 

confirmation. 

Confirm  and 
check-in 
(presses 
option) 

Remove 

boarding 

pass(es). 

A  1.5  Printer 

Prints  boarding 
pass(es). 

A  1.6  Kiosk 
Structure 

kiosk. 

Stand  on 
floor. 


Support 
structure. 
Support 
passenger. 
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Arising  from  the  initial  analysis  of  interactions  between  the  objects  of  airport 
kiosk  and  passenger,  additional  interactions  are  identified  that  may  enhance  airport 
security.  For  example,  airport  building  surfaces  can  be  used  as  another  object  to  interact 
with  a  passenger.  In  this  instance,  the  building  support  structure  provides  a  means  to 
record  the  shoeprint  while  the  passenger  is  checking  in  at  the  airport  kiosk.  From  the 
interaction  between  the  passenger  and  an  appropriate  sensor  on  the  building  floor,  one 
could  record  or  identify  a  shoeprint.  For  example,  a  hyper- spectral  sensor  could  compare 
bands  of  equal  energy  partitioning  with  a  standardized  set  of  observable  parameters  (e.g., 
pollen,  soil  composition,  material  constituents).  Multiple  spots  within  the  airport  system 
could  provide  opportunities  for  such  interaction  with  the  passenger.  Two  measurements 
of  the  passenger’s  attributes  may  provide  an  exploitable  means  for  security  analysis: 

•  A  passenger’s  shoes  could  be  scanned  by  optical  sensors  performing  a 
hyper- spectral  analysis  to  identify  materials  and  compositions  underneath 
the  shoes. 

•  The  passenger’s  weight  could  be  captured  in  database  records  for 
subsequent  reference  and  matching. 

Applying  the  methods  of  physical,  functional,  and  process  decomposition  within  a 
supply  chain  structure  provides  an  opportunity  for  capturing  additional  information 
pertaining  to  the  passenger.  This  hyper-spectral  information  (Hammer  et  al.,  1996; 
Hammer  et  al.,  2001)  could  tell  a  story  of  where  the  passenger  had  been  prior  to  the 
airport.  Measurement  of  weight  and  spectral  content  could  be  incorporated  and  designed 
into  interaction  spots  between  the  passenger  and  the  building  floor  at  strategic  locations 
across  the  paths  of  passenger  flow  from  the  moment  the  passenger  arrives  at  the  airport 
until  reaching  the  boarding  gate.  While  the  passenger  may  not  walk  or  stop  over  the 
designated  interaction  spots  (e.g.,  a  passenger  may  choose  to  check  in  online  instead  of  at 
the  airport  kiosk),  data  could  still  be  collected  so  long  as  there  are  sufficient  collection 
points  spread  across  the  entire  airport  system.  These  data  points  could  provide  a  profile  of 
the  passenger  as  he  passes  through  different  phases  of  the  passenger  flow  (refer  to  flow  as 
depicted  in  Figure  8)  in  the  airport  system.  From  a  single  profile  of  one  passenger, 
multiple  interactions  with  the  same  passenger  could  result  in  a  pattern  of  behavior  that 
accumulates  over  different  trips,  thereby  providing  a  database  and  records.  Similarly, 
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collecting  information  on  all  passengers  will  uncover  common  patterns  of  behavior  that 
can  be  used  for  the  identification  of  behavioral  anomalies  in  passengers.  Security  would 
now  be  able  to  better  assess  and  profile  a  particular  passenger  based  on  the  possible 
places  that  he  could  have  been  to  or  on  the  particular  activity  that  he  could  be  involved 
with  prior  to  traveling  to  the  airport.  In  a  like  manner,  the  weight  information  captured, 
when  matched  against  existing  records  of  the  passenger(s),  could  also  shed  some  light  on 
the  passenger  since  the  last  time  he  traveled.  Any  drastic  fluctuation  of  passenger  weight 
as  he  flows  through  the  airport  system  toward  the  departure  gate  could  possibly  signify 
that  he  may  be  carrying  additional  weight  on  his  body,  something  that  might  be  worth 
verifying  by  security. 

2.  Process  Baggage  Check-in  (Airline  Counter  Perspective)  versus 
Check-in  Baggage  (Passenger  Perspective) 

Passengers  on  domestic  flights  commuting  for  business  purposes  or  short  trips 
would  likely  be  traveling  light  with  only  hand-held  baggage  compared  to  other 
passengers  traveling  for  vacation,  relocation  and  extended  visits  on  both  domestic  and 
international  flights.  Such  passengers  are  likely  to  have  check-in  baggage.  For  each  of  the 
available  passenger  check-in  options,  there  are  corresponding  baggage  check-in  options 
(James,  n.d.)  to  support  passengers  traveling  with  baggage  that  needs  to  be  checked  in.  In 
one  of  these  options,  the  airline  counter  interacts  with  the  passenger  to  provide  the 
function  of  processing  baggage  check-in. 

The  decomposition  of  the  baggage  check-in  process  and  the  results  of  interactions 
between  the  objects  of  airline  counter  system18  and  the  passenger  based  on  a  typical  case 
for  a  passenger  processing  check-in  baggage  are  shown  in  Table  2. 


18  The  different  objects  at  the  airline  counters  supporting  the  baggage  check-in  function  and  associated 
processes. 
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Table  2.  Results  of  Interactions  between  Functions  and  Processes  of  Airline  Counter 

System  and  Passenger. 


Airport  System 

Passenger 

Physical  Object 

Function 

Process 

Physical 

Object 

A2.0  Airline 

Counter  System 

1.2. 1.1  Process  baggage  check-in. 

2.3.1  Drop  check-in 
baggage. 

P1.0 

Passenger 

Results  of  Interactions 

Walk  up  to  airline  counter. 

A2.1  Weighing 

Scale 

Support  check-in  baggage. 

Place  check-in  bag  on 
weighing  scale. 

Measure  weight  of  individual  bag. 

Display  weight  of  individual  bag  on 
screen. 

A2.2  Airline 
ground  crew 

Check  ID  and  travel  documents  and 
process  check-in  baggage. 

Present  ID  and  travel 
documents. 

Key  in  passenger  details  to 
computer  system. 

A2.3  Airline 
computer  system 

Assign  check-in  baggage  to 
passenger  records. 

A2.2  Airline 
ground  crew 

Check  weight  of  check-in  bag 

Print  bag  label(s)  for  bag. 

A2.4  Printer 

A2.2  Airline 
ground  crew 

Remove  bag  label(s)  from  printer. 

Peel  bag  label(s)  and  affix  on 
bag(s). 

Transfer  baggage  onto  baggage 
conveyor  belt  (part  of  baggage 
handling  system). 

Starts  baggage  conveyor  belt  to 
move  check-in  baggage  for 
screening,  processing  and  loading. 

Remove  labeled  odd-size 
baggage  19  for  separate 
check-in. 

Give  claim  check  for  baggage  to 
passenger. 

Check  number  of  pieces  of 
check-in  baggage  against 
number  of  claim  check  for 
baggage. 

Return  ID  and  travel  documents. 

Keep  ID  and  travel 
documents. 

A2.5  Bag  label(s) 

Provide  identification  details 
(destination,  reference  number)  for 
baggage. 

A2.6  Claim  check 
for  baggage 

Provide  copy  of  identification 
details  for  baggage. 

Safe  keep  claim  check  for 
baggage. 

A2.7  Baggage 
conveyor  belt 

Move  check-in  baggage  for 
screening,  processing  and  loading. 

- 

Leave  airline  counter. 

19  Depending  on  the  specific  airport  procedures,  passengers  may  be  required  to  bring  the  labeled  odd 
size  baggage  from  the  airline  counter  to  a  separate  the  TSA  counter  accepting  and  processing  odd  size 
check-in  baggage. 
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From  the  analysis  of  the  interactions  between  the  objects  of  the  airline  counter 
system  and  the  passenger,  it  can  be  seen  that  the  airline  ground  crew  is  the  key  object 
providing  the  interface  for  the  baggage  check-in  processes.  The  assumption  taken  in  the 
airline  counter  system  is  that  the  airline  ground  crew  handling  a  particular  baggage 
check-in  process  is  a  reliable  person  who  has  passed  some  form  of  personnel  screening 
(Morrison,  2002)  as  part  of  the  employment  process  and  is  trusted  to  perform  the 
processes  without  undermining  baggage  security.  In  the  design  of  the  EBSP  layer  of 
security  measures,  trusting  the  airline  ground  crew  to  handle  check-in  baggage  processes 
without  undermining  baggage  security  is  further  backed  up  by  the  100%  screening  of  all 
check-in  baggage  to  identify  any  baggage  that  could  potentially  compromise  security. 
Similarly,  in  the  case  of  a  passenger  self-help  baggage  check-in  at  the  airport  kiosk,  any 
act  by  the  passenger  to  tamper  with  the  check-in  baggage20  would  likewise  be  discovered 
by  the  EBSP.  Nevertheless,  this  screening  of  check-in  baggage  could  only  be  as  effective 
as  the  individuals  operating  and  running  the  system.  This  provides  a  potential  area  where 
airport  security  could  exploit  the  existing  monitoring  system  on  the  EBSP  to  extend  the 
coverage  to  include  monitoring  of  activities  around  and  within  the  EBSP. 

3.  Screen  Passenger  (Security  Checkpoint  Perspective)  versus  Clear 
Security  (Passenger  Perspective) 

The  passenger  security  screening  system  itself  is  an  SoS  composed  of  the  X-ray 
system  (A3.1)  and  its  associated  objects,  the  metal  detector  system  (A3. 2)  and  its 
associated  objects  together  with  the  human  system  in  the  form  of  the  checkpoint  security 
officer  (A3. 3).  Collectively,  these  systems  and  objects  interact  with  the  passenger  based 
on  the  defined  security  processes  to  provide  the  function  of  screening  passengers  and 
certifying  them  for  entry  into  the  concourse  area  and  eventually  to  board  the  scheduled 
flight.  The  decomposition  of  the  clear  security  process  and  the  resulting  interactions  are 
shown  in  Table  3. 


20  This  includes  odd-size  baggage  that  is  checked-in  separately. 
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Table  3.  Results  of  Interactions  between  Functions  and  Processes  of  Passenger 

Security  Screening  System  and  Passenger. 


Airport  System 

Passenger 

Physical  Object 

Function 

Process 

Physical  Object 

A3.0  Passenger 
Security  Screening 
System 

1.2. 2. 3  Screen  Passenger. 

2.4  Clear  Security 

Process 

P1.0  Passenger 

A3.1  X-ray  System 

1.2. 2. 3.1  Screen  carry-on 
and  belongings. 

A3. 2  Metal 

Detector  System 

1.2. 2. 3. 2  Screen 
individual. 

Results  of  Interactions  -  between  X-ray  system  and  Passen 

ger 

A3. 3  Checkpoint 
security  officer 

Control,  direct  flow  and 
instruct  passengers  to 
different  screening  station 
lines. 

Enter  passenger  security 
checkpoint. 21 

Evaluate  passengers 
entering  the  screening 
system. 

A3. 1.1  Table 

Support  items  (trays, 
carry-on,  belongings. 

Put  belongings  on  table. 

A3. 1.2  Tray 

Hold  carry-on  and 
belongings. 

Pick  up  tray. 

Put  carry-on  in  tray. 

A3. 1.3  Conveyor 
system 

Support  tray(s). 

Put  tray  with  carry-on 
on  conveyor  belt. 

Present  tray(s)  to  X-ray 
machine  at  a  particular 
rate  of  flow. 

A3. 1.2  Tray 

Hold  carry-on  and 
belongings. 

Pick  up  another  tray. 

Remove  belongings  and 
put  them  in  tray. 

Remove  electronic  items 
from  bags  and  put  them 
in  tray. 

Remove  water  bottle, 
food  container,  3-1-1 
carry-on  from  bag(s) 
and  put  them  in  tray. 

Empty  pockets,  remove 
belt  and  shoes,  and  put 
them  in  tray. 

-1  This  refers  to  the  point  after  the  passenger  has  cleared  the  DTC  checks  and  is  next  in  the  line  to 
enter  the  security  checkpoint. 
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A3. 1.4  X-ray 
operator 


A3. 1.5  X-ray 
machine 


A3. 1.6  X-ray 
display  unit 


A3. 1.4  X-ray 
operator 


A3. 3  Checkpoint 
security  officer 


Switch  on  conveyor 
system. 


Move  conveyor  belt 
forward. 


Reproduce  image(s)  of 
items  in  tray(s). 


Send  image  to  display 
unit. 


Display  received  image. 


Assess  and  evaluate 
image  on  display  unit. 


Stop,  reverse  conveyor 
belt  if  necessary. 


Request  assistance  for 
additional  physical 
check(s)  on  suspicious 
item(s). 


Identify  and  ask  owner  of 
suspicious  item(s)  to  step 
aside  for  additional 
check(s). _ 


Request  owner  to  open  up 
bag(s)  containing 
suspicious  item(s). 


Examine,  check  and 
evaluate  suspicious 
item(s). 


Conduct  test  (if 
necessary)  on  suspicious 
item(s). 


Transfer  tray(s)  from  end 
to  stai't  of  conveyor 
system. 


Put  tray  with  belongings 
on  conveyor  belt. 


Proceed  to  go  through 
metal  detector  screening 
(see  interactions  with 
metal  detector  system). 


Acknowledge  as  owner 
of  bag(s). 


Assist  and  open  up 
bag(s). 


Remove  suspicious 
item(s)  for  additional 
check(s). 


Keep  checked  item(s). 


Take  carry-on  off 
tray(s). 


Keep  belongings  from 
tray(s). _ 


Take  belt,  shoes  and 
wear  them. 


Return  tray(s). 


Exit  security 
checkpoint. 


A3. 4  Queue  post 

To  separate  and 

Stay  within  lines. 

and  lines 

demarcate  lines  and  the 

different  screening 

stations. 
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Results  of  Interactions  -  between  Metal  detector  system  and  Passenger 


A3. 2.1  Security 
officer  manning 
metal  detector 
station 

Trigger  and  direct 
passengers  to  come 
through  metal  detector. 

Wait  for  turn  to  go 
through  metal  detector 
as  instructed. 

A3. 2.2  Metal 
detector 

Transmit  signal  to  test  for 
metallic  object(s.) 

Walk  through  metal 
detector. 

Receive  reflected  signal. 

Analyze  reflected  signal. 

Sound  alarm  if  metallic 
object(s)  detected. 

A3. 2.1  Security 
officer  manning 
metal  detector 
station 

Observe  passenger  as  they 
go  through  metal  detector 
and  watch  for  triggered 
alarm. 

A3. 2. 3  Anti-static 

mat 

Support  passenger. 

Step  aside  for  additional 
check(s)  if  alarm  is 
triggered. 

A3. 2.1  Security 
officer  manning 
metal  detector 
station 

Check,  assess  and 
evaluate  offending 
item(s). 

Remove  item(s)  that 
triggered  alarm. 

Perform  hand-held  scan 
on  passenger. 

Present  item(s)  to 
security  officer. 

A3. 2.4  Hand-held 
metal  scanner 

Trigger  alarm  if  metal  is 
detected. 

Wait  for  additional 
check(s)  to  be 
completed. 

Go  through  metal 
detector  again  if 
necessary. 


Analysis  of  the  interactions  between  X-ray  system  and  the  passenger  revealed  a 
trade  space  between  the  elements  of  the  X-ray  technology,  the  competency  of  X-ray 
operator,  the  rate  at  which  trays  flow  through  the  system  and  the  processes  governing  the 
screening  of  carry-on  baggage  and  belongings.  From  the  function  of  presenting  trays 
loaded  with  carry-on  baggage  and  belongings  by  the  conveyor  belt  to  the  X-ray  machine 
for  assessment,  there  is  a  possibility  to  speed  up  and  improve  the  performance  of  security 
by  means  of  resolving  any  bottleneck  caused  by  the  X-ray  machine  process.  Similar  to  a 
supply  chain,  the  bottleneck  determines  the  throughput  of  the  supply  chain.  This 
throughput  is  directly  dependent  on  the  number  of  trays  waiting  in  the  line  (conveyor 
belt)  to  undergo  security  screening  and  the  rate  at  which  each  of  these  trays  clears 
screening.  In  an  X-ray  system,  the  conveyor  belt  is  usually  not  fully  optimized  with  trays 
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lined  up  back  to  back.  By  providing  more  trays,  passengers  could  potentially  get  ready 
well  ahead  of  reaching  the  screening  point,  removing  all  carry-ons  and  belongings  and 
putting  these  items  into  the  trays.  Compared  to  a  bottleneck  in  a  supply  chain,  when 
passengers  remove  their  carry-on  baggage  and  belongings  right  in  front  of  the  X-ray 
machine,  the  conveyor  belt  often  runs  without  trays  briefly.  The  speed  at  which  trays 
clear  screening  is  dependent  on  the  X-ray  technology  and  the  corresponding  flow  rate 
associated  with  the  conveyor  belt,  as  well  as  the  defect  assessment  competency  of  the  X- 
ray  operator(s)  in  keeping  up  with  the  flow. 

While  there  are  means  to  improve  these  elements,  they  are  fundamentally 
dependent  on  the  rule  set  as  defined  by  the  TSA  screening  guidelines.  This  set  of  security 
rules  defined  by  the  TSA  has  a  causal  effect  on  the  passenger  flow  rate  through  the 
passenger  security  screening  system  and  the  total  amount  of  time  each  passenger  spends 
at  the  security  checkpoint22.  This  defined  rule  set  also  provides  the  basis  for  the 
identification  of  known  defects  that  the  passenger  security  screening  system  is  designed 
to  undertake.  Depending  on  the  complexity  of  each  rule,  there  is  a  function  relating  to  the 
amount  of  time  required  for  that  rule  to  be  checked  off  passengers  going  through  the 
passenger  security  screening  system.  In  additional  to  the  rule  set,  there  is  a  corresponding 
consequence  on  time  spent  at  the  security  checkpoint  as  a  result  of  known  defects  arising 
from  the  violation  or  ignorance  of  the  rule  set  on  the  part  of  the  first-time  or  non-frequent 
flyers  who  may  not  be  familiar  with  the  requirements. 

The  configuration  of  the  security  checkpoint  in  terms  of  the  number  of  checking 
stations  and  lines  and  the  number  of  security  officers  manning  each  of  these  offers  a  trade 
space  for  the  throughput  of  the  passenger  security  screening  system.  Given  the  same 
number  of  deployed  security  officers,  there  are  two  possible  models  of  configuration.  A 
configuration  in  which  resources  are  spread  out  to  maximize  the  possible  number  of 
checking  stations  and  lines  versus  one  with  fewer  stations  and  lines  but  with  each  being 
more  optimally  staffed.  In  the  model  of  spreading  out  available  security  officers  to 


22  A  passenger  whose  carry-on  and  belongings  have  undergone  x-ray  screening  and  have  personally 
gone  through  the  metal  detector  may  still  need  to  spend  time  to  resolve  any  alarm  triggered  by  suspicious 
item(s),  thereby  increasing  his  time  at  the  security  checkpoint. 
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achieve  the  maximum  number  of  security  stations  and  lines,  there  would  likely  be 
stoppages  in  the  flow  of  passengers  in  the  passenger  security  screening  system  when 
suspected  known  defects  are  being  stopped  for  assessment  and  evaluation  by  the  security 
officer  manning  the  station  and  line.  While  a  fewer  stations  and  lines  configuration’s 
defect  assessing  capability  at  any  time  is  lower,  it  could  potentially  minimize  stoppages 
in  the  flow  of  passengers  through  the  system  even  in  the  presence  of  suspected  defective 
passengers.  Security  officers  who  are  not  deployed  to  man  the  additional  stations  and 
lines  could  be  redeployed  to  augment  the  remaining  stations  and  lines  by  handling  and 
resolving  all  potentially  defective  cases.  These  defective  passengers  could  be  “pulled”  out 
of  the  line  for  separate  assessment  and  evaluation  by  the  redeployed  officers  while  the 
continuous  flow  of  passengers  through  the  system  continues  undisrupted. 

Observing  and  analyzing  each  and  every  passenger  to  identify  potential  defects23 
as  they  flow  through  the  system  provides  another  trade  space  for  consideration.  A 
centralized  airport  passenger  security  screening  model  only  supports  the  observation  and 
analysis  of  passenger  behavioral  traits  with  a  broad  common  baseline  that  all  of  them  are 
passengers  scheduled  for  an  upcoming  flight.  Decentralizing  this  security  screening 
through  relocating  and  deferring  the  security  checkpoints  to  the  respective  departure 
gates  or  groups  of  departure  gates  would  provide  a  more  defined  and  narrowly  scoped 
baseline  in  terms  of  having  to  observe  and  analyze  behavioral  traits  and  activities  of 
passengers  who  are  scheduled  to  be  on  the  same  flight.  Chances  are,  passengers  traveling 
on  the  same  flight  to  the  same  destination  may  exhibit  commonalities  in  behavioral  traits 
associated  with  the  particular  flight  or  destination,  thereby  providing  a  more  distinct  basis 
for  the  identification  of  anomalous  behavior  compared  to  a  more  generic  basis.  In 
addition,  pushing  out  the  security  checkpoints  and  screening  to  the  departure  gates  also 
has  other  benefits.  It  would  minimize  the  existing  security  requirements  placed  on  all 
other  non-passengers  within  the  concourse  area.  In  this  configuration  there  is  no  longer  a 
need  to  maintain  a  sterile  area  to  match  the  security  certified  passengers  after  they  clear 
the  security  checkpoint  and  enter  the  concourse  area.  With  the  security  checkpoints  at  the 

23  These  are  not  known  defects  as  defined  and  listed  by  the  TSA  rule  set  but  are  rather  behavioral 
aspects  of  individuals  that  could  provide  the  slightest  of  indication  that  the  passengers  could  be  defective. 
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respective  gates,  the  available  time  and  space  between  clearing  security  checkpoints  and 
boarding  the  flight  at  the  respective  gates  reduces  the  set  space  for  any  possible  change  of 
passenger  status  to  defective.  There  would  be  less  opportunity  for  any  passengers  with  a 
malicious  intent  to  act  and  behave  in  a  manner  that  would  result  in  defects  from  the  time 
they  clear  the  relocated  security  checkpoint  until  they  board  the  schedule  flight.  While 
this  improves  aviation  security  with  terrorist  using  aircraft  as  a  weapon,  it  can  potentially 
open  up  and  present  other  security  risks  to  the  airport  operations  or  infrastructure  now 
that  security  screenings  are  being  pushed  forward  to  the  respective  gates. 

It  can  also  be  seen  from  the  analysis  of  the  interactions  that  a  data  capturing 
opportunity  rests  at  the  point  before  the  start  of  the  passenger  security  screening  system. 
Passengers  can  scan  their  boarding  pass  to  register  the  time  of  security  screening  before 
sending  their  carry-ons  and  belongings  on  tray(s)  to  the  X-ray  system.  The  ensuing 
results  of  the  security  screening  or  any  subsequent  details  could  be  tagged  to  the  records 
and  data  of  the  individual  passenger.  Similarly,  the  X-ray  images  could  also  be  time 
stamped  and  tagged  to  the  respective  passenger.  Besides  providing  useful  information  as 
part  of  real-time  monitoring  and  tracking,  this  information  collected  over  multiple  travels 
of  the  same  passenger  could  provide  a  reference  profile  for  security  exploitation  and 
could  come  in  useful  during  investigation.  Any  additional  verification  conducted  on 
suspicious  item(s)  should  also  be  time  stamped  and  tagged  to  the  respective  passenger’s 
records  and  data.  The  walk-through  metal  detector  could  also  serve  as  one  of  the 
designated  interaction  spots  for  the  collection  of  weight  and  hyper-spectral  information 
pertaining  to  the  passenger. 
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4.  Surveillance  of  Airport  Environment  and  Surrounding  (Surveillance 
Camera  Perspective)  versus  Fulfill  Wants/Needs  (Passenger 
Perspective) 


Table  4.  Results  of  Interactions  between  Functions  and  Processes  of  CCTV 

Surveillance  System  and  Passenger. 


Airport  System 

Passenger 

Physical  Object 

Function 

Process 

Physical  Object 

A4.0  CCTV 
Surveillance 
System 

1.2. 2.4  Surveillance  of  airport 
environment  and  surrounding 

2.7.2  Fulfill  Wants/  Needs 
(Shop) 

P1.0  Passenger 

Results  of  Interactions 

A4.1 

Surveillance 

Camera 

Capture  footages  within  field 
of  view  (FOV)  of  surveillance 

camera. 

Enter  shop. 

Enter  field  of  view  of  a 
specific  surveillance  camera. 

Walk  around  to  browse 
merchandise. 

Pick  up  merchandise  from 
display  units  to  see,  feel, 

"play"  with  item. 

Put  merchandise  back  down 
on  display  units. 

Speak  to  a  sales  person  to 
find  out  more  about  specific 
merchandise. 

Pick  up  shopping  basket, 
push  cart. 

Remove  merchandize  from 
display  unit  and  put  in 
shopping  basket  or  push  cart. 

Exit  field  of  view  of  existing 
surveillance  camera  to  enter 
sector  (FOV)  monitored  by 
another  surveillance  camera. 

Leave  shop  to  enter  common 
airport  domain. 

Streaming  of  LIVE  footage 
captured  to  video  management 
system. 

A4.2  Video 

Management 

System 

Receive  incoming  footage 
streams  from  various 
surveillance  cameras. 

A4.3  Video 
Storage  System 

Record  and  store  streamed 
footages  in  accordance  to  time 
sequence. 

A4.4  Security 
officer  at 
command  center 

Select  specific  footage  to  be 
displayed,  monitor  and 
maintain  oversight  of  footage 
on  display. 

A4.2  Video 

Management 

System 

Select  specific  footage  as 
requested  by  operator  and  pipe 
it  to  display  monitor(s). 

A4.5  Display 
Monitor(s) 

Display  live  streamed  footage 
piped  by  Video  Management 
System. 

A4.4  Security 
Officer  at 
command  center 

Select  a  specific  segment  of 
footage  from  a  specific 
surveillance  camera  to  be  play 
back  for  analysis,  assessment, 
etc. 

A4.2  Video 

Management 

System 

Process  play  back  request  to 
connect  to  Video  Storage 
System  to  retrieve  footage. 

A4.5  Display 
Monitor(s) 

Display  retrieved  footage  from  'i ''XHfflBHPSt 

Video  Storage  System  in  play  ^ 

back  request.  | 
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From  the  analysis  of  the  interactions  between  the  CCTV  surveillance  system  and 
the  passenger,  it  can  be  seen  that  there  is  an  avenue  to  monitor  and  track  the  passenger, 
his  activities  and  interactions  continuously  from  the  moment  he  enters  the  airport  system 
boundaries,  which  are  being  constantly  surveyed  by  security  sensors  and  surveillance 
cameras.  His  progress  through  the  different  phases  as  he  approaches  the  departure  gates 
could  be  tracked  through  a  suite  of  surveillance  cameras  within  the  airport  system 
providing  coverage  of  his  physical  progression  within  the  system.  The  coverage  on  a 
particular  passenger  captured  by  the  various  surveillance  cameras  could  be  stitched 
together  to  provide  a  pattern  on  the  passenger’s  behavior,  interactions  and  activities  that 
he  had  undertaken  across  the  different  phases.  Thus,  a  profile  could  be  assembled  and 
used  for  security  assessment.  Coupled  with  video  analytics  capabilities,  this  assembled 
footage  could  then  be  assessed  and  analyzed  for  anomalies  that  would  otherwise  be 
flagged  for  additional  security  verification. 
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V.  INTEGRATED  RISK  MANAGEMENT 


The  concept  of  risks,  uncertainties  and  the  associated  risk  assessment  of 
potentially  defective  goods  as  they  flow  through  the  supply  chain  are  discussed  in  this 
chapter. 

A.  OVERVIEW 

Risk  is  a  structural  property  of  the  interactions  between  objects  (Langford,  2012), 
an  important  result  from  interactions  and  processes  within  a  system  or  SoS.  Risk 
assessment  and  analysis  form  an  integral  part  of  the  analysis  of  the  airport  passenger 
security  system,  providing  context  to  the  uncertainties  and  risks  associated  with  the  goods 
as  they  flow  through  the  supply  chain.  There  are  two  commonly  implemented  approaches 
to  risk  assessment  based  on  the  perspective  of  risk,  either  as  a  structure  of  objects 
(methodology)  or  as  a  process.  Within  the  methodology-based  perspective  of  risk,  risk 
assessment  can  be  temporal-  or  event-based  depending  on  the  set  of  pre-identified 
conditions;  for  example,  risk  assessments  could  be  performed  as  part  of  a  procedure  when 
a  specific  event  (such  as  foiled  terrorist  attempt)  occurs.  Process-based  risk  assessment 
occurs  in  the  context  of  decision  making  (Langford,  2012).  Additionally,  a  third  approach 
to  risk  assessment  is  used  in  systems  thinking.  That  is,  risk  is  viewed  as  a  consequence  of 
actions  and  interactions  between  objects  and  processes  (nexus).  This  approach  is  used  in 
conjunction  with  structural  objects  and  processes  resulting  in  a  system  and  an  SoS 
perspective,  combined  (Langford,  2013). 

•  The  SoS  view  promotes  separation  of  the  systems,  implying  a  process- 
based  approach.  In  the  SoS  view  the  objective  is  interoperability  with  high 
coupling  and  high  cohesion. 

•  The  systems  view  promotes  integration  of  the  systems  at  a  meta-systems 
level,  implying  objects.  In  the  systems  view,  the  objective  is 
interoperability  with  low  coupling  and  low  cohesion. 

B.  RISK  INDEX  (RI) 

There  are  many  ways  to  qualify  risk  assessment,  and  one  of  them  is  in  the  form  of 
a  risk  index.  From  an  SoS  perspective,  different  systems  making  up  the  system  would 
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each  have  an  RI  that  is  additive  in  nature  for  the  system  compared  to  the  system 
perspective  of  having  a  multiplicative  RI.  In  the  context  of  the  airport  passenger  security 
system,  the  discussion  on  RI  in  the  following  segments  focuses  on  the  system 
perspective,  assuming  that  the  existing  security  system  is  a  perfect  one  without  any  flaws 
(i.e.,  all  entities  and  processes  function  as  they  were  designed  and  intended). 

1.  Risk  Index  of  Passenger  Flow  in  Supply  Chain 

The  concept  of  the  RI  in  the  passenger  flow  within  the  supply  chain  is  that  every 
passenger  bound  for  air  travel  possesses  a  certain  RI  that  would  be  computed  as  part  of 
the  risk  assessment  of  the  passenger  as  he/she  flows  through  the  various  phases  of  the 
supply  chain.  According  to  the  risk-based  approach  taken  by  TSA  at  all  U.S.  airports,  the 
majority  of  passengers  is  deemed  to  be  of  low  risk  (TSA,  2013,  March  14)  and  this 
translates  to  a  low  initial  RI  that  is  assigned  to  all  passengers.  In  the  flow  toward  the 
aircraft,  the  RI  increases24  as  the  passenger  physically  passes  through  each  phase  of  the 
supply  chain  and  progresses  nearer  to  the  aircraft,  thereby  increasing  the  assessed  risk 
associated  with  the  passenger  on  board  the  aircraft. 

a.  Risk  Assessment  Scenario 

An  individual  (known  as  Andrew25)  with  a  hand-held  sized  bag  boarded  a 
train  traveling  in  the  direction  toward  the  airport  at  one  of  the  stations  along  the 
transportation  line.  Like  all  other  commuters  on  board  the  train,  Andrew  was  assigned  an 
initial  (low)  RI  so  as  to  initiate  the  tracking  and  monitoring  of  the  individual’s  risk  index. 
Andrew  behaved  like  other  commuters,  settling  in  a  seat.  While  his  boarding  location  and 
direction  were  known,  his  intentions  and  final  destination  were  unknown  as  he  could 
potentially  disembark  at  any  station  along  the  way.  At  one  of  the  other  stations,  another 
individual  (known  as  Billy)  boarded  the  train  with  a  hand-held  sized  bag  and  two  check¬ 
in  sized  bags.  Billy  found  a  seat  beside  Andrew  and  sat  down.  Like  Andrew,  Billy  was 

24  The  assumptions  taken  in  this  increasing  RI  approach  is  that  all  passengers  possess  some  form  of 
risk  and  the  fact  that  they  have  progress  nearer  to  the  aircraft  would  translate  into  a  higher  risk  for  the 
aircraft. 

25  For  the  purpose  of  ease  of  reference,  arbitrary  names  have  been  given  to  individual  passengers  in 
the  scenario. 
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also  assigned  a  low  RI  except  that  his  intentions  and  final  destination  were  clearer 
compared  to  Andrew;  Billy  seemed  bound  for  the  airport.  Andrew  and  Billy  did  not  talk 
to  each  other  throughout  the  journey.  Andrew’s  final  destination  became  clear  as  the  train 
pulled  out  of  the  last  station  before  the  airport.  With  him  on  board  the  train  which 
terminated  at  the  airport,  he  would  be  exiting  with  all  remaining  commuters  bound  for  the 
airport.  As  the  train  pulled  into  the  airport  perimeter,  Andrew  stood  up  and  picked  up  one 
of  Billy’s  check-in  bags  and  went  to  the  door,  waiting  for  the  train  to  stop  at  the  airport. 
At  the  terminating  station,  both  Andrew  and  Billy  left  in  different  directions,  each  with  a 
hand-held  bag  and  a  check-in  sized  bag.  Andrew  has  clearly  taken  one  of  Billy’s  check-in 
bags  along  with  him. 

At  the  airport,  Billy  went  straight  to  a  “Food  &  Beverage”  counter, 
grabbed  a  coffee  and  sat  down  while  Andrew  visited  the  restroom.  Thereafter,  Andrew 
used  one  of  the  airport  kiosks  to  process  his  check-in.  He  answered  “Yes”  to  one  of  the 
system  assigned  questions  asking  if  he  had  packed  his  check-in  bag  himself.  In  another 
question,  he  answered  “No”  when  asked  if  his  bag  had  ever  left  his  possession.  When 
Billy  checked  in  at  the  airline  counter,  he  gave  similar  answers  to  the  same  set  of 
questions.  In  addition,  he  answered  “No”  when  quizzed  if  he  was  traveling  with  someone 
else  and  if  he  knew  anyone  on  board  the  same  flight.  Thereafter,  both  proceeded 
separately  to  the  passenger  security  screening  checkpoint  to  gain  access  into  the 
concourse  area.  After  verifying  the  authenticity  of  their  travel  documents  and  boarding 
pass  details  at  the  document  checking  station,  the  document  checker  arbitrarily  waved 
them  to  separate  security  checks  and  inspection  lines.  Both  Andrew  and  Billy  were 
scheduled  for  the  same  outbound  flight  and  have  seats  diagonally  across  the  aisle.  Like 
all  other  passengers,  Andrew  whisked  through  the  physical  inspections  via  X-ray 
machines  and  metal  detectors  without  triggering  any  security  violations.  Although  Billy 
had  lots  of  sharp  office  materials  such  as  geometry  sets,  t-pins  and  letter  openers,  he  too 
was  waved  through  the  security  checkpoint  as  none  of  them  were  items  on  the  TSA’s 
prohibited  items  that  could  not  be  brought  onto  airplanes  in  carry-on  baggage  (TSA, 
2013,  June  11).  In  the  concourse  area,  Andrew  met  up  with  Charles  who  had  earlier 
cleared  the  security  though  he  was  stopped  briefly  for  having  a  couple  of  screwdrivers 


49 


and  scissors26  in  his  carry-on  bag  that  were  within  TSA  allowable  limits.  Charles  was 
slated  to  be  seated  beside  Billy.  David  was  seated  at  the  gate  area  waiting  for  boarding. 
Earlier,  he  had  his  set  of  pocketknives  surrendered  at  the  security  checkpoint  while  his  set 
of  knitting  needles  was  allowed  through  (TSA,  2013,  January  21). 

b.  Risk  Index  Discussion 

This  section  focuses  on  the  risk  index  allocated  to  an  individual  passenger 
and  how  it  would  change  as  a  result  of  interactions  and  flow  toward  the  aircraft,  a 
mechanism  for  risk  assessment  of  passengers. 

(1)  Airport  Boundary  Phase: 

In  the  physical  movement  of  a  passenger  in  the  airport  system  as 
shown  in  Figure  4,  the  passenger  enters  the  airport  boundary  well  before  reaching  the 
airport  domain.  The  goal  in  this  phase  is  to  identify  behavior  or  activities  by  individual 
commuters  on  board  the  train  that  would  not  be  normally  observed  and  differentiate  them 
from  the  usual  observations  of  train  commuters.  Once  within  the  behavioral  and 
functional  boundaries  of  the  airport,  the  focus  switches  to  behavior  or  activities 
associated  with  commuters  traveling  to  the  airport  now  that  it  is  confirmed  that  all 
remaining  commuters  on  board  are  destined  for  the  airport.  The  review  of  surveillance 
footage  for  the  April  15  Boston  Marathon  bombings  showed  that  the  suspects  “acted 
differently  than  everyone  else.  When  the  bombs  blow  up,  when  most  people  are  running 
away  and  victims  were  lying  on  the  ground,  the  two  suspects  walk  away  pretty  casually" 
(Smith  &  Patterson,  2013). 

Similar  to  the  Boston  suspects,  individuals  with  suspected  defects 
would  likely  act  or  behave  differently  from  the  rest  of  the  normal  passengers.  Both 
Andrew  and  Billy  were  assigned  an  initial  RI  like  all  other  commuters  on  board  the  train. 
During  the  journey  on  board  the  train,  they  did  not  exhibit  any  behavior  that  would  have 
singled  them  out  from  the  other  commuters.  As  the  train  pulled  into  the  airport  station, 
however,  Andrew  took  a  check-in  bag  brought  on  board  by  Billy.  That  was  an  unusual 

26  Screwdriver  less  than  seven  inches  and  scissors  less  than  four  inches  are  allowed  to  be  carried  on 
board  all  flights  (TSA,  2013,  June  1 1). 
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event  within  the  behavioral  boundary  of  the  airport,  and  it  increased  Andrew’s  RI  to  a 
level  that  warrants  some  attention  from  the  security  authorities.  Similarly,  Billy  allowed 
this  bag  to  be  taken  off  the  train  by  someone  with  whom  he  did  not  speak  throughout  the 
journey;  this  was  not  a  normally  observed  act  and  it  also  increased  his  RI. 

(2)  Airport  Domain  and  Check-in:  Within  the  airport  domain, 
tests  and  checks  would  be  conducted  to  verify  the  presence  of  defects.  Generally,  there 
are  two  types  of  tests,  Type  1  and  Type  2.  Type  1  tests  are  defined  as  being  conducted  to 
verify  suspicion  based  on  knowledge  and  information  about  passengers,  while  Type  2 
tests  are  conducted  to  identify  or  detect  new  or  known  defects.  The  increased  RIs  of  both 
Andrew  and  Billy  as  a  result  of  their  actions  on  board  the  train  were  indicative  of  the 
presence  of  potential  flaws  in  the  goods  along  the  supply  chain.  Once  the  RI  exceeded  the 
pre-defined  additional  testing27  threshold,  suspected  flaws  would  be  tested  for 
deficiencies.  The  goods  would  be  subjected  to  a  series  of  Type  1  tests,  and  depending  on 
the  outcome  of  these  tests  and  checks,  the  RIs  could  increase,  decrease  or  remain  the 
same.  Besides  the  outcome  of  tests  and  checks,  RI  could  also  be  affected  by  other 
sightings  of  indifferent  behavior  and  activities  that  continued  to  be  monitored  and  tracked 
during  the  phase.  Type  2  tests  and  checks  are  also  conducted  arbitrarily  in  this  phase  to 
identify  or  detect  defects.  Tests  and  checks  could  be  incorporated  as  part  of  the 
mainstream  supply  chain  process  flow  within  the  phase,  such  as  a  static  built-in  test  in  the 
form  of  questions  and  answers  during  check-in  at  airport  kiosks  or  over  the  airline 
counters.  Alternatively,  tests  and  checks  could  be  triggered  dynamically  whenever 
necessary  and  could  be  in  support  of  both  types  of  testing.  Tests  and  checks  could  be 
activated  anytime  along  the  entire  supply  chain  to  verify  the  presence  of  defects  or 
identify  new  or  known  defects  within  the  goods.  This  could  be  in  the  form  of  interactions 
between  security  personnel  and  the  respective  passenger  within  the  domain,  be  it  standing 
in  the  line  or  moving  around.  These  could  entail  simple  conversational  questions,  such  as 
asking  where  are  the  passengers  traveling  to,  where  did  they  buy  their  nice  luggage,  etc., 
and  observing  their  responses  including  factual  replies  and  non-verbal  cues. 


27  These  are  tests  conducted  in  addition  to  those  done  at  the  security  checkpoints. 
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While  facial  expression  can  provide  meaningful  insights  into  what  a 
person  is  thinking  and  feeling,  individuals  can  possibly  put  on  a  false  face 
when  they  are  lying,  conniving,  or  trying  to  influence  the  perception  of 
others  through  false  smiles,  fake  tears,  or  deceiving  looks.  Observers 
would  have  to  be  mindful  that  these  signals  can  be  faked,  so  the  best 
evidence  of  true  sentiment  is  derived  from  clusters  of  behaviors,  including 
facial  and  body  cues,  that  buttress  or  complement  each  other.  By  assessing 
facial  behaviors  in  context  and  comparing  them  to  other  nonverbal 
behaviors,  one  can  use  them  to  help  reveal  what  the  brain  is  processing, 
feeling,  and/or  intending  (Navarro,  2008). 

In  this  instance,  Andrew’s  RI  has  further  increased  as  his  check-in  reply  did  not  match 
the  activities  that  happened  earlier  on  board  the  train;  clearly  he  had  lied.  While  Billy  had 
not  lied  about  his  luggage,  his  RI  had  also  increased  by  virtue  of  the  fact  that  he  is  nearer 
to  the  aircraft.  With  each  test  being  used  as  a  basis  to  determine  the  RI  of  the  individual 
of  concern,  tests  and  checks  could  be  conducted  throughout  the  remaining  phases  until 
such  a  point  where  the  RI  goes  down  to  an  acceptable  risk  index  region  or  when  the  result 
of  a  particular  test  clearly  indicates  the  presence  of  defects  in  the  form  of  security 
violations  that  warrant  the  goods  be  removed  from  the  product  process  and  out  of  the 
supply  chain  (i.e.,  ban  or  stop  from  boarding  the  scheduled  flight  through  arrests  or 
assistance  in  further  investigations). 

(3)  Security  Checkpoints:  In  this  phase,  passengers  are  checked 
and  inspected  against  known  defects,  such  as  having  the  matching  (passenger  matches  the 
ID  that  was  presented)  travel  documents  (including  passport/government  issued  ID,  valid 
boarding  pass,  etc.  that  are  authentic);  passenger  and  respective  carry-on  bags  being  x- 
rayed  and  inspected  for  the  presence  of  TSA  prohibited  items.  These  are  generally  Type  2 
tests  aimed  at  detecting  known  defects  though  they  could  be  used  to  supplement  Type  1 
testing  in  certain  scenarios.  The  outcomes  of  these  tests  and  checks  for  known  defects 
would  be  conclusive  with  either  a  pass  or  a  failure.  Any  inconclusive  outcome  would  be 
tested  repeatedly  until  a  conclusion  is  made.  The  assumptions  taken  in  this  phase  would 
be  that  all  security  checks  and  tests  administered  are  effective  and  competent  in  the 
detection  and  identification  of  known  security  defects  or  observations.  At  the  end  of  the 
phase,  all  individuals  passing  the  security  tests  and  checks  against  known  defects  would 
have  their  RI  increased  given  that  everyone  have  progressed  nearer  to  the  aircraft. 
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However,  an  individual’s  RI  would  increase  more  if  the  security  tests  and  checks  fail. 
These  variations  of  the  RI  would  be  based  on  one  of  the  following  possible  outcomes. 


•  Passed  through  security  checkpoint  without  any  security  defect  or 
observation.  Passenger  clears  and  passes  through  the  checks  without  the 
detection  of  any  prohibited  item.  RI  would  be  maintained  since  most 
passengers  were  assumed  to  enter  the  phase  with  a  low  RI,  so  not  having 
any  security  violation  would  maintain  that  low  RI.  There  would  be  no 
unintentional  reduction  of  RI  of  a  suspected  passenger  because  no  new 
defects  were  identified  in  this  phase  as  opposed  to  the  observations  of  his 
behavior  and  activities  that  were  dubious  in  the  earlier  phases.  However, 
the  cumulative  effect  on  the  RI  is  such  that  it  would  increase  at  the  end  of 
the  phase  as  passenger  moved  nearer  to  the  aircraft. 

•  Stopped  at  security  checks  with  security  defect(s)  or  observation. 

Passenger  subsequently  clears  and  passes  through  with  the  rectification  of 
the  defect  or  observation,  possibly  through  the  removal  of  the  offending 
item(s)  (i.e.,  thrown  away  or  confiscated).  With  the  rectification  of  the 
defect,  the  RI  would  be  maintained  though  the  type  and  nature  of  the 
security  observations  would  be  noted  for  subsequent  reference.  Similarly, 
the  cumulative  effect  at  the  end  of  the  phase  constitutes  an  increased  RI. 

•  Stopped  at  security  checks  with  security  defect(s)  or  observation. 

Passenger  physically  arrested  and  removed  from  flight  with  the  offending 
item(s)  being  detained.  RI  would  increase  beyond  the  defect  threshold 
following  the  arrest.  Type  and  nature  of  security  observations  would  be 
noted  for  future  reference. 

Both  Andrew  and  Billy  cleared  the  security  checks  without  any  security  defect  and  had 
their  RI  increased  like  all  other  passengers  at  the  end  of  the  phase,  though  an  observation 
was  made  on  Billy’s  possession  of  a  large  quantity  of  sharp  office  materials.  Charles  who 
did  not  have  any  prior  observation  from  the  earlier  phases  cleared  the  security  check  also 
with  an  RI  within  the  acceptable  region.  However,  observation  was  made  on  his 
possession  of  screwdrivers  and  scissors.  David  had  been  stopped  at  the  security  checks 
for  a  brief  clarification  after  pocketknives  were  found  in  his  carry-on  bag.  The  quick 
rectification  of  the  detected  security  defect28  did  not  increase  his  RI  though  his  RI  went 
up  at  the  end  of  the  phase  as  a  result  of  his  progress  toward  the  aircraft. 


28  Defect  rectified  through  the  surrendering  of  the  detected  pocketknives. 
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(4)  Concourse  and  Departure  Gates:  As  the  goods  flow  through 
this  last  phase  of  the  supply  chain,  tests  and  checks  continue  to  be  conducted  on  the 
suspected  goods  that  have  yet  to  be  verified  as  defect  free  or  within  the  acceptable  risk 
index.  Dynamic  Type  1  tests  would  continue  to  be  conducted  on  these  suspicious  goods 
until  the  RI  reaches  an  acceptable  risk  index  level,  exceeds  the  defect  threshold  that 
would  result  in  an  arrest  or  when  boarding  commences,  whichever  occurs  first.  At  the 
same  time,  goods  would  also  continue  to  be  monitored  and  tracked  for  behavior  or 
activities  that  could  affect  RI.  Exhibited  behavior  could  be  mapped  against  earlier 
exhibited  behavior  for  consistency  matching.  Any  significant  deviation  from  the  earlier 
exhibited  behaviors  or  any  variation  from  behaviors  exhibited  by  passengers  bound  for 
the  same  flight29  at  the  gate  area  could  result  in  a  further  increase  of  RI.  Consistency  in 
behavior  against  earlier  behaviors  and  behaviors  of  passengers  bound  for  same  flight 
would  maintain  the  same  RI  level.  RI  could  be  reduced  if  the  observed  activities  are 
conclusive  that  the  goods  are  defect  free.  An  example  would  be  the  voluntary  check-in  of 
all  carry-on  bags  by  a  suspected  individual  who  now  no  longer  has  access  to  his  carry-on 
bags. 


c.  Analysis  of  Risk  Index 

An  example  of  the  risk  index  profile  plot  for  the  respective  passengers  as 
they  progress  through  the  various  phases  toward  the  aircraft  is  shown  in  Figure  14. 


29  Behaviors  of  passengers  from  the  same  flight  could  be  further  categorized  into  same  gender 
passengers  who  have  similar  profiles  in  terms  of  age,  marital  status,  etc. 
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The  initial  phases  of  the  supply  chain  flow  would  focus  on  identifying 
goods  suspected  of  being  potentially  defective.  Once  a  particular  good  is  suspected  to  be 
defective,  it  would  undergo  a  series  of  Type  1  tests  to  verify  the  presence  of  defects. 
Besides  the  Type  1  test,  a  Type  2  test  would  also  be  conducted  to  identify  new  or  known 
defects.  Depending  on  the  outcome  of  the  tests  and  checks,  this  entire  process  could  well 
stretch  over  the  different  phases  until  boarding  with  a  lowered  RI  or  a  breached  RI  (one 
that  had  exceeded  the  RI  defect  threshold). 

None  of  the  tracked  individuals’  RI  has  breached  the  defect  threshold 
though  Andrew  and  Billy  had  RIs  above  the  acceptable  region.  These  two  passengers 
have  a  higher  risk  index  profile  than  the  normal  passenger.  However,  on  its  own,  the  RI 
within  the  medium  risk  sector  may  not  be  a  concern.  In  a  similar  fashion,  two  similar 
tests  conducted  separately  may  seem  not  to  have  any  intrinsic  meaning.  However,  the  co¬ 
relation  of  RIs  with  their  associated  events  could  actually  point  to  some  useful 
information,  especially  when  tests  results  are  correlated  with  an  earlier  observed  activity 
that  required  further  scrutiny.  In  this  instance,  tracing  the  monitored  activities,  behaviors 
and  observations  of  the  individual  passenger  the  moment  he  enters  the  boundaries  of  the 
airport  system  and  then  mapping  them  alongside  each  other  for  analysis  and  comparison 
to  identify  commonalities  or  differences  provides  insights  to  the  observed  situation. 

™  Gaps  have  been  intentionally  created  in  the  risk  index  profile  to  delineate  the  respective  passenger’s 
risk  profile  plot  across  the  different  phases. 
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The  Type  1  tests31  administered  separately  on  Andrew  and  Billy  at 
different  locations  and  test  stations  have  linked  them  together  based  on  what  had 
happened  earlier  on  board  the  train  when  Andrew  took  Billy’s  check-in  bag.  This 
observation  was  a  result  of  the  interaction  of  information  between  the  test  system  and  the 
monitoring  system  and  the  ability  to  synthesize  both  pieces  of  information  to  produce  the 
conclusion  of  suspected  defect.  It  would  appear  that  there  was  something  unusual  about 
the  four  passengers.  From  the  observed  activities  and  interactions  (Andrew  linking  up 
with  Charles  at  the  concourse,  Andrew  picking  up  Billy’s  check-in  bag,  Charles  seated 
beside  Billy)  they  appeared  to  be  linked  and  to  know  each  other  though  this  is  not 
explicitly  displayed  or  shown.  David  likewise  has  a  common  link  with  Billy  and  Charles 
in  the  form  of  less  common  observations  noted  during  security  screening  checks  in  terms 
of  possession  of  sharp  objects.32. 

These  connections  and  linkages  of  observed  activities  and  behaviors, 
coupled  with  the  details  of  security  screening  of  the  corresponding  check-in  bags  and 
other  associated  information33  available  to  the  airport  security  system,  provided  a 
systems  perspective  in  the  analysis  of  the  collective  risk  index  profile  associated  with  all 
passengers  on  board  the  same  flight.  This  collective  picture  for  a  particular  flight 
provided  a  basis  for  the  decision  on  the  type  of  security  measures  or  safeguards  that  could 
be  implemented  in  preparation  for  any  uncertainties  onboard  the  aircraft  subsequently.  In 
this  instance,  the  collective  risk  index  for  the  flight  has  exceeded  the  individual  risk 
index,  entering  the  medium-high  risk  sector,  given  the  dubious  relationships  amongst  the 
four  passengers  and  the  pattern  that  they  collectively  exhibit  (in  the  form  of  bringing 
unusual  sharp  objects  on  board  the  flight).  The  fact  that  it  was  inconclusive  to  dismiss  the 
presence  of  suspected  defect(s)  in  the  passengers  further  prompted  the  need  for  additional 
safeguards  on  board  the  flight. 

31  These  are  questions  on  packing  of  check-in  bag  and  if  the  bag  had  ever  left  the  individual’s 
possession. 

32  Sharp  objects  such  as  knitting  needles  and  screwdrivers  could  be  used  as  a  weapon  on  people 
(“Scotland’s  courts  seize  thousands  of  knives,”  2011)  (Shupe,  2013;  Kaplan,  1993). 

33  Refers  to  information  that  serves  as  inputs  into  the  airport  system.  For  example,  information  on  the 
manner  in  which  the  flight  tickets  were  booked  (tickets  booked  together,  bought  using  the  same  credit  card, 
etc.) 
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d.  Application  of  Real-time  Monitoring  and  Tracking  of  Risk  Index 
Profile 

According  to  Fernandez  and  Jones  (2013),  a  disgruntled  man  was  hurt 
after  detonating  a  home-made  explosive  in  the  Beijing  airport  on  20  July  2013.  As 
reported  by  FlorCruz  (2013),  the  wheelchair-bound  man  was  stopped  by  airport  security 
when  he  began  distributing  leaflets  to  publicize  his  cause.  “Shortly  after  his  standoff  with 
airport  security,  the  disgruntled  petitioner  detonated  his  devices”  (FlorCruz,  2013). 
Airport  security  had  seen  the  wheelchair-bound  man  distributing  pamphlets  earlier  and 
stopped  him  without  further  actions.  While  the  wheelchair-bound  man  was  not  a 
passenger  scheduled  for  any  flight,  the  concept  of  risk  index  would  probably  have  made  a 
difference  in  this  case.  Had  the  man’s  movements  within  the  airport  boundaries  been 
tracked  with  his  risk  index  being  profiled  and  monitored,  there  could  been  tell-tale  signs 
that  would  have  possibly  flagged  him  for  earlier  security  intervention. 
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VI.  CONCLUSION  AND  RECOMMENDATIONS 


A.  CONCLUSION 

A  systems  perspective  was  taken  to  investigate  the  airport  passenger  security 
system  with  the  intention  of  identifying  new  perspectives  on  security  and  ways  to 
enhance  aviation  security.  In  the  analysis  of  the  airport  passenger  security  system,  a 
supply  chain  approach  was  adopted  to  detect  defects  in  passenger  for  security.  Passengers 
were  viewed  as  goods  moving  along  the  supply  chain  with  each  phase  being  a  means  to 
check  for  security  conformance,  to  be  defect-free  and  ready  for  boarding.  The  supply 
chain  approach  coupled  with  the  methodological  analysis  of  interactions  between  airport 
objects  and  passengers  (as  objects)  as  the  later  flow  toward  the  aircraft  provided  insights 
and  new  perspectives  on  the  passenger  security  system.  Through  this  process,  new 
security  measures  and  processes  were  identified. 

Numerous  data  acquisition  opportunities  exist  within  the  supply  chain  to  allow 
security  to  assess  and  profile  individual  passengers.  Based  on  the  possible  use  of  hyper- 
spectral  analysis  of  passenger  shoe  to  identify  materials  and  compositions  underneath 
shoes,  security  authorities  could  have  a  clearer  picture  of  the  possible  places  the 
individual  could  have  been  to  or  particular  activity  that  he  could  be  involved  with  prior  to 
the  travel  to  the  airport.  The  analysis  of  the  interactions  between  the  X-ray  system  and  the 
passenger  revealed  a  trade  space  between  the  elements  of  the  X-ray  technology,  the 
competency  of  X-ray  operator,  the  rate  at  which  trays  flow  through  the  system,  and  the 
processes  governing  the  screening  of  carry-on  and  belongings.  While  there  are  means  to 
optimize  this  trade  space  for  a  more  efficient  throughput  of  passenger  during  screening, 
the  elements  are  fundamentally  dependent  on  the  defined  rule  set  for  security  screening. 

The  current  security  concept  of  batch  screening  of  passengers  through  a 
centralized  passenger  security  screening  model  could  be  further  improved.  Correlation 
between  passengers  and  their  scheduled  flights  and  between  passengers  on  the  same 
flight  could  be  achieved  through  decentralized  screenings  at  the  respective  departure 
gates  or  groups  of  departure  gates.  This  decentralized  security  screening  model  would 
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provide  a  more  refined  baseline  in  terms  of  behavioral  traits  and  activities  of  a  common 
group  of  passengers  bound  for  the  same  aircraft,  thereby  increasing  the  granularity  of  the 
security  assessment.  Compared  to  a  centralized  security  screening  model,  the 
decentralized  security  screening  at  departure  gates  also  minimized  the  set  space  for  any 
possible  change  of  passenger  status  to  defective. 

The  existing  surveillance  capabilities  within  and  around  the  airport  boundaries 
could  be  used  to  piece  together  a  real-time  profile  of  every  passenger  based  on  the  pattern 
of  behavior,  interactions  and  activities  undertaken  across  the  different  phases  toward  the 
aircraft.  Coupled  with  the  concept  of  RI  profiling  of  every  passenger,  this  monitoring  and 
tracking  of  individual  profiles  and  status  could  improve  the  probability  of  identifying 
potentially  defective  passengers  before  they  board  any  aircraft. 

While  improvements  to  the  identified  security  measures  and  processes  could 
enhance  aviation  security,  the  airport  passenger  security  system  can  only  be  as  effective 
as  the  individuals  operating  and  running  these  processes,  as  human  beings  remain  a 
vulnerable  inside  link  that  is  susceptible  to  exploitation  by  terrorists. 

B.  RECOMMENDATIONS 

In  the  interest  of  similar  area  of  studies,  future  research  could  consider  expanding 
the  scope  of  analysis  beyond  the  airport  passenger  security  system  to  involve  other 
objects  within  the  airport  that  have  interactions  with  the  aircraft  or  with  any  other  objects. 
These  other  objects  may  include  passengers  and  flight  crew  onboard  the  aircraft. 

Arising  from  the  thesis  research,  the  existing  airport  infrastructure  was  identified 
as  one  of  the  key  limitations  of  the  current  system.  This  was  an  inherent  limitation  given 
that  the  post  9/11  security  measures  were  “quickly”  incorporated  into  existing  airports  at 
that  time,  working  around  constraints  posed  by  the  airport  infrastructure.  Trade-offs  were 
made  within  the  system,  maximizing  one  aspect  while  using  the  remaining  variables  to 
trade-off  security.  From  a  cost-effectiveness  perspective,  aviation  travel  was  “secured” 
without  regard  for  cost  within  a  short  timeframe  after  9/11.  While  the  cost-effectiveness 
of  the  airport  security  system  has  improved  over  time,  as  depicted  in  Figure  15,  it  has  a 
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fixed  baseline,  possibly  constrained  by  the  inherent  infrastructure,  something  that  can  be 
resolved  if  the  limitation  was  changed. 


A  hypothetical  model  for  the  airport  passenger  security  system  of  the  future  was 
envisaged  (without  the  fundamental  infrastructure  as  a  constraint),  and  this  model  can  be 
further  researched  subsequently.  The  hypothetical  model  for  airport  passenger  security 
system  of  the  future  is  shown  in  Figure  16. 
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Figure  16.  Hypothetical  Model  for  Airport  Passenger  Security  System  of  the  Future. 


This  model  shows  the  relationship  between  the  passenger  and  the  deployed 
security  technology  and  process.  Figure  16  is  a  plot  of  loss  (in  terms  of  cost)  versus 
performance  (in  terms  of  throughput  or  otherwise  known  as  security  efficiency  in  the 
form  of  feet  moved  per  second)  of  passengers  through  the  airport  passenger  security 
system.  From  the  passenger  perspective,  an  increase  in  throughput  with  a  faster  rate  of 
movement  across  the  airport  domain,  clearing  security  in  a  shorter  period  of  time  would 
come  at  a  higher  loss  (i.e.,  more  costly)  to  the  individual.  Conversely,  a  slower 
throughput  would  correspondingly  lower  the  cost  incurred  by  each  individual.  In  the 
deployment  of  advanced  security  technologies  and  improved  security  processes,  security 
authorities  strive  toward  improving  security  efficiency  with  a  lower  cost  (i.e.,  improved 
security  would  lower  the  loss  associated  with  the  loss  of  life,  damage  to  aircraft  and 
infrastructure,  and  economical  loss  resulting  from  terrorist(s)  hijacking  an  aircraft).  At 
the  end  toward  zero  throughput,  the  loss  to  security  is  infinite  (as  security  technologies 
and  processes  are  inadequate  to  detect  and  identify  terrorists  boarding  aircrafts)  as  the 
passengers  never  make  it  to  their  destination. 
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The  intersection  of  both  the  passenger  and  the  security  technology  and  process 
curve  as  shown  at  Point  A  reflects  the  current  state  of  security  technologies  and 
processes,  and  the  corresponding  level  of  loss  that  is  “acceptable,”  the  corresponding  cost 
of  security  to  the  passenger  and  the  resulting  rate  of  flow  through  the  airport. 

The  aim  is  to  move  down  the  security  technology  and  process  curve  to  reduce  loss 
resulting  from  the  hijacking  of  aircraft  while  maintaining  or  lower  the  cost  of  security  to 
each  passenger.  This  can  be  achieved  through  improving  the  “gradient”  of  the  passenger 
curve,  shifting  point  A  toward  point  B  as  shown  in  Figure  17. 


Figure  17.  Long  Term  Model  Improvement. 


Further  research  could  look  into  areas  that  could  facilitate  this  movement  along 
the  security  curve  to  achieve  greater  throughput  at  a  lower  cost.  For  example,  the 
concurrent  approach  of  being  security  screened  while  moving  through  airport  toward  the 
aircraft  as  compared  to  the  existing  sequential  approach  through  the  different  phases  at 
the  airport  domain.  Through  the  deployment  of  advanced  security  technology  and 
changes  in  security  processes  (paradigm  shift  from  the  existing  way  in  which  airports  are 
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being  built  and  operate),  the  passenger  upon  entering  the  physical  boundary,  could 
possibly  be  transported  to  the  doorsteps  of  the  aircraft  and  get  security  screened 
concurrently  while  onboard.  There  will  be  scope  for  analysis  within  this  identified  trade 
space  and  work  toward  the  eventual  end  state  of  maximum  throughput  and  lowered 
security  loss.  This  increased  efficiency  will  eliminate  the  need  to  be  at  the  airport  well  in 
advance  of  scheduled  departure  to  accommodate  the  different  phases,  including  security 
screening.  Instead,  travelers  will  need  only  to  allow  sufficient  time  for  the  transportation 
and  movement  from  the  physical  boundary  of  the  airport  to  the  doorsteps  of  the  aircraft 
with  security  screening  being  performed  concurrently. 
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